RPC Server Unavailable in Windows Server: Complete Troubleshooting Guide

RPC lets Windows components and applications request work from another computer. A failure does not necessarily mean the RPC service itself is stopped. A healthy RpcSs service can still be unreachable because the hostname resolves to the wrong address, a route is missing, TCP 135 is blocked, or the dynamic RPC endpoint used after the initial connection is blocked.

Run the tests from the system that is experiencing the failure. Compare the server name with the expected IP address and test the route before changing firewall rules.

Resolve-DnsName server01
Test-Connection server01 -Count 2
Test-NetConnection server01 -Port 135

If DNS resolves incorrectly, fix the DNS record or client DNS configuration first. If TCP 135 fails, focus on routing, network ACLs and Windows Firewall before troubleshooting the application.

Get-Service RpcSs,RpcEptMapper,DcomLaunch | Select Name,Status,StartType

The core RPC services should be running. Do not restart services repeatedly during an incident without checking Event Viewer and dependent workloads. Record the service state and recent Service Control Manager events so the change can be correlated with the incident.

TCP 135 is used by the RPC Endpoint Mapper. A successful ping does not prove RPC connectivity because ICMP and TCP are controlled separately.

Test-NetConnection server01 -Port 135
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction,DefaultOutboundAction
Get-NetFirewallRule -PolicyStore ActiveStore | Where-Object Enabled -eq 'True' | Select DisplayName,Direction,Action,Profile

For domain-joined servers, also check the effective firewall profile and the rules required by the workload. Avoid disabling the firewall as a blanket test. Validate the required rule or port from the affected source to the affected destination.

This is a common turning point. TCP 135 only proves that the Endpoint Mapper can be reached. The client may then be directed to a dynamic RPC port. If that second connection is blocked, applications such as WMI or some remote administration tools can still fail.

Check the application's documentation for its RPC requirements and review network firewalls for the required dynamic RPC range. In controlled environments, administrators can configure a constrained RPC port range, but the configuration must be planned consistently across servers and network security controls.

For domain controller issues, check DNS health, replication and required services rather than treating every RPC error as a firewall problem.

dcdiag /test:dns
repadmin /replsummary
Get-Service RpcSs,DNS,Netlogon,KDC | Select Name,Status

For WMI or MMC failures, identify the exact operation that fails and test it from the same client. This helps distinguish a general RPC path problem from a problem specific to WMI, DCOM permissions or the management tool.

Review the System log and the event logs for the affected application, service or role. Correlate the timestamp with network changes, service restarts, firewall policy changes, DNS changes and server reboots. Capture the event ID and full message before remediation.

• DNS fails: fix name resolution and verify the returned address.
• DNS works, TCP 135 fails: investigate route, ACL and Windows Firewall.
• TCP 135 works, RPC application fails: investigate dynamic RPC ports and the specific service.
• Services are stopped: determine why before restarting them.
• Only one management tool fails: test the underlying service and permissions instead of assuming a general RPC outage.

Is TCP 135 the only RPC port?

No. TCP 135 is the Endpoint Mapper. The application can use another dynamically assigned RPC endpoint after the initial lookup.

Does ping working mean RPC should work?

No. Ping tests ICMP. RPC troubleshooting should include a TCP 135 test and, where required, the application-specific endpoint.

Should I disable Windows Firewall to test RPC?

Do not use blanket firewall disabling as the default test. Identify the effective profile and required rule or port, then validate the connection path.