This step-by-step article describes how to troubleshoot Remote Procedure Call (RPC) Endpoint Mapper errors in Windows Server 2003 and Windows 2000 Server by using tools and utilities that are available in the Support folder of the Windows Server 2003 or Windows 2000 Server CD-ROM or that are available as part of the Windows Server 2003 Resource Kit or the Windows 2000 Server Resource Kit. Remote Procedure Call is a protocol that is used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to run code on a remote system.

In certain situations, when you try to force Active Directory replication by using Active Directory Sites and Services, when you try to promote an additional domain controller by using the Dcpromo tool, or when you run netdom query fsmo from a command line, you may receive an error message that is similar to the following:Other symptoms may include:

•	When you try to log on to the domain, you may receive an error message that is similar to the following: The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect.
•	You cannot open Group Policy snap-ins.
•	When you try to open Active Directory Administrative Tools, such as Active Directory Users and Computers or Active Directory Sites and Services, you may receive the following error message: The specified domain either does not exist or could not be contacted.
•	You cannot browse the domain in Network Neighborhood.
•	You receive the following error message when you try to map drives or view resources on a remote server: Access denied.
•	File Replication Service (FRS) may be slow or fail completely. For example, the Sysvol folder may fail to replicate between domain controllers. When this occurs, you may receive a message similar to the following in the Ntfrs_000<x>.log files: RPC Unavailable
•	Microsoft Outlook may fail when connecting to a Microsoft Exchange server. When this occurs, you may receive username and password prompts when you open Outlook. When you enter valid credentials, you may receive an error message similar to the following: Your logon information is incorrect -OR- Outlook could not logon.
•	Also, when you click Check Name while creating a new mail account in Outlook, you may receive an error similar to the following: The name could not be resolved. The name could not be matched to a name in the address list.

Note If you use a network capture program, such as Network Monitor, to capture network traffic, the computer may not receive a response when it tries to establish an RPC session to another computer by using any port greater than 1024. The sending computer uses the Universal Unique Identifier (UUID) for the RPC Endpoint Mapper. The UUID for the RPC Endpoint Mapper is E1AF8308-5D1F-11C9-91A4-08002B14A0FA.

Back to the top

Back to the top

The Dcdiag tool

The Dcdiag tool analyzes the state of domain controllers in a forest or in an enterprise and reports any problems to help in troubleshooting. You can use the Dcdiag tool to help troubleshoot RPC Endpoint Mapper errors when you run the Dcdiag tool. To do this, follow these steps:

1.	Click Start, click Run, type cmd in the Open box, and then click OK.
2.	Type dcdiag, and then press ENTER.

If RPC Endpoint Mapper problems exist, the Dcdiag tool may respond with error messages that are similar to the following:

Back to the top

The Netdiag tool

You can use the Netdiag tool to help isolate networking and connectivity problems. You can use the Netdiag tool to help troubleshoot RPC Endpoint Mapper problems. To do this, follow these steps:

1.	Click Start, click Run, type cmd in the Open box, and then click OK.
2.	Type netdiag, and then press ENTER.

If RPC Endpoint Mapper problems exist, the Netdiag tool may respond with error messages that are similar to the following:

Back to the top

The Repadmin tool

You can use the Repadmin tool for Active Directory replication, for troubleshooting Active Directory replication problems, and for troubleshooting RPC Endpoint Mapper problems. To do this, follow these steps:

1.	Click Start, click Run, type cmd in the Open box, and then click OK.
2.	Type Repadmin /bind, and then press ENTER.

If RPC Endpoint Mapper problems exist, the Repadmin tool may respond with an error message that is similar to the following:

Back to the top

The Ntdsutil tool

Enterprise and domain administrators can use the Ntdsutil tool to manage and repair Active Directory, and to help troubleshoot RPC Endpoint Mapper problems. To help troubleshoot RPC Endpoint Mapper problems, follow these steps:

1.	Click Start, click Run, type cmd in the Open box, and then click OK.
2.	Type NTDSUtil ?, and then press ENTER.
3.	At the ntdsutil: prompt, type Metadata cleanup, and then press ENTER.
4.	At the metadata cleanup: prompt, type Connections, and then press ENTER.
5.	At the Connections: prompt, type Connect to server localhost, and then press ENTER.

If RPC Endpoint Mapper Problems exist, the Ntdsutil tool may respond with an error message that is similar to the following:

Back to the top

The Gpotool tool

You can use the Gpotool tool to check the consistency of Group Policy objects on domain controllers. The Gpotool tool is contained in the Windows Server 2003 Resource Kit. You can download the Windows Server 2003 Resource Kit by visiting the following Microsoft Web site:After you have installed the Resource kit, you can use the Gpotool tool to help troubleshoot RPC Endpoint Mapper problems. To do this, follow these steps:

1.	Click Start, point to Programs, click Windows Resource Kit Tools, and then click Command Shell.
2.	Type gpotool, and then press Enter.

If RPC Endpoint Mapper Problems exist, the Gpotool tool may respond with an error messages that are similar to the following:

Back to the top

Event Viewer

The following events may be logged on a domain client, on a member server, or on a domain controller when RPC does not function correctly:

Event ID: 1053
Event Source: Userenv
Description: Windows cannot determine the user or computer name. (There are no more endpoints available from the endpoint mapper. ). Group Policy processing aborted.

Event ID: 1000
Event Source: Userenv
Description: Windows cannot determine the user or computer name. Return value (1753). :

Event ID: 1168
Source: NTDS General
Description: Error -1073741823(c0000001) has occurred (Internam ID 3000b35). Please contact Microsoft Product Support Services for assistance.

Event ID: 1265
Source: NTDS KCC
Description: The attempt to establish a replication link with parameters Partition: CN=Configuration,DC=contoso,DC=com Source DSA DN: CN=NTDS Settings,CN=ServerName,CN=Servers,CN=domainname,CN=Sites,CN=Configuration,DC=contoso,DC=com Source DSA Address: 70863dce-1031-47ea-a567-2f46212dd361._msdcs.securityroot.com Inter-site Transport (if any): CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=securityroot,DC=net failed with the following status: There are no more endpoints available from the endpoint mapper. The record data is the status code. This operation will be retried.

Event ID: 1656
Event Source: NTDS General Event
Description: The Directory Service was unable to find any RPC protocol sequences installed on this computer, failing with error 1719. The Directory Service will be unable to respond to any RPC requests as long as this condition persists.

Event ID: 10010
Event Source: DCOM
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Event ID: 4097
Event Source: EventSystem
Description: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070005 from line 42 of .\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

Event ID: 1012
Event Source: Winlogon
Description: The automatic certificate enrollment subsystem could not access local resources needed for enrollment. Enrollment will not be performed. (0x800706d9) There are no more endpoints available from the endpoint mapper.

On an enterprise certification authority server, or on a subordinate certification authority server, an event that is similar to the following may be logged:

Back to the top

The Dcpromo tool

The Active Directory Installation Wizard (Dcpromo.exe) promotes Windows Server-based computers to be domain controllers. When the Dcpromo tool fails because of RPC problems, error messages that are similar to the following may appear in the DCPromo.log file.

Note The Dcpromo.log file is located in the %windir%\Debug folder.

Note These error codes represent the following:

•	Error code 58 represents "The specified server cannot perform the requested operation."
•	Error code 1722 represents "The RPC server is unavailable."
•	Error code 1753 represents "There are no more endpoints available from the endpoint mapper."

Additionally, the DCPromoUI.log may report an error message that is similar to the following:

Back to the top

The Active Directory Migration Tool

The Active Directory Migration Tool (ADMT) may generate events that are similar to the following in the Event Viewer on the computer where the ADMT is run:

Event ID: 1540
Event Source: NTDS Replication
Description: Error 1753, DSID 11a05b1, adding SID to object ?.

The log from Clonepr.vbs from %windir%\debug appears as follows:

clonepr t:0x5CC 00254        HRESULT = 0x800706D9 
clonepr t:0x5CC 00255        Enter GetErrorMessage 800706D9 
clonepr t:0x5CC 00256        Exit  GetErrorMessage 800706D9 
clonepr t:0x5CC 00257        Enter SetComError Failed to add the source SID to the destination object's SID history. The error was: "There are no more endpoints available from the endpoint mapper. " 
clonepr t:0x5CC 00258        Exit  SetComError Failed to add the source SID to the destination object's SID history. The error was: "There are no more endpoints available from the endpoint mapper. " 

Back to the top

How to resolve RPC Endpoint Mapper errors

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
The "No more endpoints available" error message means the RPC Endpoint Mapper was not able to use a port greater than 1024 for a service that runs over RPC.
Note RPC Endpoint Mapper runs on port 135.

RPC can use ports up to 65535. By default, all versions of Windows use only ports 1024-5000. To repair the RPC Endpoint Mapper, follow these steps:

1.	Verify the status and startup type for the following services on the server that gets the error: Type of computer RPC service RPC Locator service Windows Server 2003-based domain controller Started, Automatic Stopped, Manual Windows Server 2003-based member server Started, Automatic Stopped, Manual Windows Server 2003-based standalone server Started, Automatic Stopped, Manual Windows 2000 Server-based domain controller Started, Automatic Started, Automatic Windows 2000 Server-based member server Started, Automatic Started, Manual Windows 2000 Server-based standalone server Started, Automatic Stopped, Manual If you make any changes to the RPC service or to the RPC Locator service settings, restart the computer, and then test for the problem again.
2.	Verify that the following keys exist in the registry (the keys are grouped according to operating system). Windows XP, Windows Server 2003 and Microsoft Windows 2000 Verify that the ClientProtocols key exists under the HKEY_Local_Machine\Software\Microsoft\Rpcregistry subkey and that the ClientProtocolsentry contains at least the following five default values: Name Type Data ncacn_http REG_SZ rpcrt4.dll ncacn_ip_tcp REG_SZ rpcrt4.dll ncacn_nb_tcp REG_SZ rpcrt4.dll ncacn_np REG_SZ rpcrt4.dll ncacn_ip_udp REG_SZ rpcrt4.dll Note The ncacn_nb_tcp value does not occur in Windows XP. Microsoft Windows NT 4.0 Verify that the ClientProtocolsentry exists under the HKEY_Local_Machine\Software\Microsoft\Rpcsubkey and that the ClientProtocolsentry contains at least the following six default values: Name Type Data ncacn_np REG_SZ rpcltcl.dll ncalrpc REG_SZ ncalrpc ncacn_ip_tcp REG_SZ RpcLtCcm.dll ncadg_ip_udp REG_SZ RpcLtCcm.dll ncadg_nb_tcp REG_SZ rpcltccm.dll ncacn_http REG_SZ rpcltccm.dll Microsoft Windows 98 Verify that the ClientProtocolsentry exists under the HKEY_Local_Machine\Software\Microsoft\Rpcsubkey and that the ClientProtocolsentry contains at least the following four default values: Name Type Data ncacn_np REG_SZ rpcltcl.dll ncalrpc REG_SZ ncalrpc ncacn_ip_tcp REG_SZ rpcltc3.dll ncacn_http REG_SZ rpcltccm.dll For more information about related topics, click the following article number to view the article in the Microsoft Knowledge Base: 325930 (http://support.microsoft.com/kb/325930/) How to troubleshoot connectivity issues that are caused by RPC client protocol registry entries To verify the client registry settings, follow these steps: a. Click Start, click Run, type regedit, and then click OK. b. In Registry Editor, locate the following subkey: HKEY_Local_Machine\Software\Microsoft\Rpc c. Make sure that the five default values that were listed earlier are present. If some or all the values are missing, you can manually add the missing values when you right-click ClientProtocols, click New, and then click String value.
3.	Verify that DNS is working correctly. To do this, follow these steps: a. On the computer that is experiencing error, click Start, click Run, type cmd, and then click OK. b. From the command line, type Netdiag -v or type ping -a IP_of_problem_server to make sure that the host record is resolving to the correct computer.
4.	Verify that ports greater than 1024 are not blocked. Clients connect to RPC Endpoint Mapper on port 135. RPC Endpoint Mapper then tells the client which randomly assigned port between 1024-65535 a requested service is listening on. The ports may be blocked by a hardware firewall, a Internet Connection Firewall on Windows Server 2003-based computer and on a Windows XP-based computer, third-party firewall software, or antivirus software that has firewall functionality built-in. By default, port 135 TCP/UDP and ports 1024-65535 TCP must be open for RPC to work. However, you can restrict the ports greater than 1024 that RPC uses. However, RPC Endpoint Mapper is always on port 135. You can also use the Portqry tool to verify that the required ports are open. You must run the Portqry tool on a computer that is not receiving any RPC errors against a computer that is receiving RPC errors by using the -n switch. To this, follow these steps: a. Click Start, click Run, type cmd in the Open box, and then click OK. b. Type portqry -n problem_server -e 135. The output will appear similar to the following examples: Querying target system called: problem_serverAttempting to resolve name to IP address... Name resolved to 169.254.1.1 querying... problem_serverTCP port 135 (epmap service): LISTENING Using ephemeral source port Querying Endpoint Mapper Database... Server's response: UUID: f5cc59b4-4264-101a-8c59-08002b2f8426 NtFrs Service ncacn_ip_tcp:65.53.63.16[1094] UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface ncacn_ip_tcp:65.53.63.16[1025] UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface ncacn_http:65.53.63.16[1029] UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface ncacn_http:65.53.63.16[6004] If port 135 is blocked, the following will appear: TCP port 135 (epmap service): NOT LISTENING However, for these RPC Endpoint Mapper errors it is likely that ports greater than 1024 are blocked, and not port 135. From the output, you know the DC is using port 1094 for FRS and 1025, 1029, and 6004 for Active Directory replication. You can use the Portqry tool again to check those ports. For example, you can test all the ports at the same time by using the Portqry tool with the -o switch. For example, type portqry -n problem_server -o 1094,1025,1029,6004 If the ports all respond as "LISTENING," its likely that blocked ports are not causing this problem. If any ports respond as "NOT LISTENING," the ports are probably blocked.
5.	You can use the three REG_DWORD values that can be added to the HKEY_Local_Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters subkey to help solve the RPC problem. Note None of the entries exist by default. • MaxUserPort This entry makes more ports available. • TcpTimedWaitDelay Reducing this value from its default setting of 240 seconds will make ports expire sooner. This parameter determines the length of time that a connection stays in the TIME_WAIT state when it is being closed. While a connection is in the TIME_WAIT state, the socket pair cannot be reused. This is also known as the 2MSL state because the value should be double the maximum segment lifetime on the network. See RFC 793 for more details. • TcpMaxDataRetransmissions The default value is 5. You may try 4 or 3, but do not try a value that is less than 3. This parameter controls the number of times that TCP retransmits an individual data segment (not connection request segments) before aborting the connection. The retransmission time-out is doubled with each successive retransmission on a connection. It is reset when responses resume. The Retransmission Timeout (RTO) value is dynamically adjusted by using the historical measured round-trip time (Smoothed Round Trip Time, or SRTT) on each connection. The starting RTO on a new connection is controlled by the TcpInitialRtt registry value.
6.	If the HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet registry key exists and has no values listed, then RPC only has one port available. By default, this registry key does not exist and if there are no values listed under this key, delete this key and then restart the server.

Note Other software programs may also cause RPC Endpoint Mapper errors, such as the following:

•	Noblenet Portmapper. This utility requires a host file pointing to itself to work correctly. Editing the host file may resolve the issue.
•	BMC Patrol agent software using the AD Knowledge Module (KM). In this case, update to the latest version, at least 1.4.01.
•	Incompatible network adapter drivers. In this case, upgrade to the latest Windows Hardware Quality Labs (WHQL) signed driver version.

Note If you do not want to continue troubleshooting, you might want to ask someone for help.Or, you might want to Contact Support (http://support.microsoft.com/contactus).

Back to the top

For more information about configuring RPC dynamic port allocation with a firewall, click the following article number to view the article in the Microsoft Knowledge Base: For more information about restricting the port FRS or Active Directory replication uses, click the following article number to view the article in the Microsoft Knowledge Base: For more information about How to restricting FRS replication traffic to a static port, click the following article number to view the article in the Microsoft Knowledge Base: For more information about port requirements for Windows Server systems, click the following article number to view the article in the Microsoft Knowledge Base: The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

If these articles do not help you resolve the problem, or if you experience symptoms that differ from those that are described in this article, search the Microsoft Knowledge Base for more information. To search the Microsoft Knowledge Base, visit the following Microsoft Web site: http://support.microsoft.com (http://support.microsoft.com/). Then, type the text of the error message that you receive or type a description of the problem in the search field.

Back to the top