How to disable RPC Services on Windows XP
Have you ever thought about disabling RPC (Remote Procedure Calls) on your Windows® XP® Box?
If you tried you might have faced this:
The drop down list for ‘Startup Type’ is disabled and set to ‘Automatic’.
This means we are not allowed to choose any option for this service (including stopping it).
Umf.. I hate people (and software) that decide what is good or bad for me!
Ok..
click Start -> Run
type ‘regedit.exe’ and move to key :
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs]
click twice on the ‘Start’ value (type DWORD) and set ‘Value Data’ to ’4′.
Now open your services list ad select ‘Remote Procedure Call (RPC)’ this is what you’ll witness:
You can finally choose your favorite startup options for this service.
:)
That’s all folks!
by ScL
feat. saver
Popularity: 100% [?]
36 Comments
defo
October 2, 2007After this, desktop main bar doesn’t work. There is just start, but no list of open apps. I have WinXP Pro SP2.
f0cus
January 9, 2008Can you explain the other DWORD entries and what they do, such as ErrorControl, FailureActions, and Type, and under Enum – Count and NextInstance, or, if not, can you post a link with explanations for those? Thank you.
fooled
January 10, 2008WARNING:
Don’t do this! I did this and I it killed my whole system!
freespeech
January 10, 2008i literally had to completely restore my hard drive after this, why would you post how to disable a critical system service?
i had no start bar and i couldnt right click the service to re-enable it, right clicking didnt work.
you should at least post instructions how to re-enable the service through the command prompt.
this page is evil.
chhris
January 18, 2008hello – i tried this and cannot copy or re-enable this service – the properties menu becomes unavailable – im stuck!
saver
January 29, 2008hi guys,
let’s start from beginning :
when i wrote this post (26th may 2005) a likeable virus called Blaster (see reference on http://www.symantec.com/security_response/writeup.jsp?docid=2003-081113-0229-99)
infected a lot of WinXp machines all around the world.
one of the way to avoid the infection was to install a firewall and the blaster patch before connecting to
the internet for the first time.
if you had not it locally (on cdrom or something else) you were screwed.
so said, an alternative way to do that, was to temporarily stop the RPC service, to fix the system, then activate it again.
Stopping RPC service causes some problems to the regular behaviour of the OS, but it can still work!
the loss of settings of the taskbar is one of these problem, as well the bad display of service panel.
however, you can easily get back to the default settings for the RPC service (once stopped) through regedit.exe
or similar programs that come within your OS, following one of these routes:
1) go to taskmanager->new task and type in the edit box “regedit.exe”
2) create a .bat file and fill it with “regedit.exe” string.then save and launch it.
3) using “reg.exe” (the command_line version of regedit.exe) from cmd
after you have guaranteed access to system registry, simply set back the “Start” value to “2″.
restart the system and everything will get back to normality.
PS : i really don’t know what you meane with “fooled” or “i literally had to completely restore my hard drive” and
“Don’t do this! I did this and I it killed my whole system!”…
simply, don’t play with the system registry if you don’t know exactly what you are doing! :)
and, above all, make always a backup file of the key you are going to edit (File->Export in regedit.exe applcation)
last PS : this trick was useful when blaster was a real security problem (may 2005).
doing this stuff today with you SP2 installed, has no sense.
anyway, i did the trick (on my WinXp Pro Sp2) after reading your comments
and didn’t find any problem in starting the RPC service back.
last advice : if you want your WindowsXP (or Vista) never give you any problem again,
just shutdown your pc, buy a Mac and use OsX :)
saver
Carmella Bing
February 4, 2008I read your blog in a regular manner and just love it
hope there will be more postings from you, keep on going
greetz, carmella
Tom W
April 15, 2008Hi Saver
Thanks for trying to help us “dabblers in matters we should leave alone”. I tried everythig you said above and still no joy (still unable to access properties page of rpc service) – tried changing the value to 2 (on the bat key and the start key)restarting on each occasion but still no change.
Could you explain a little more fully about how to create the bat file please and fill it with regedit.exe as I managed to create a key called regedit.exe but I didn’t know how to “Save and launch it”. I’m just reinstalling xp over my current system (which will hopefully retain all my programs/files) but I’d still be interested to know and it may save someone else the 1 hour 30 minutes required to reinstall (probably should have gone for the “repair” option but there ya go…
Wes
August 25, 2009Given all of the shit that breaks when you do that, it seems that preventing someone from disabling RPC is entirely reasonable.
Richard Amiss
August 26, 2009Really? You guys are complaining because you tried something that you know nothing about and don’t even know what it does?
If someone wrote a blog about how to hang yourself would you complain to the blogger that you accidentally died?
If you don’t know what it does then why would you even do it in the first place?
ubi
August 26, 2009good comment, richard.
I also have to say that I would thoroughly look at the post date before attempting anything.
many things might have changed since may 26 2005 in matters of RPC etc.
of course saver would be better than me at this, as he wrote the post.
I’m a mac user and don’t even want to know what this does.
saver
August 26, 2009hi guys,
as i said, this trick was useful to patch WinXp against Blaster worm.
however, Blaster or anything else, playing with registry keys is ALWAYS a dangerous practice.
as most of specialized security weblogs say, is a good behavior to make a system restore point or, at least, data backup before playing with any OS.
i would like to say again that, after reading your comments (“this is evil”, “it killed my whole system” and so on), i did the trick and i was easily able to make WinXp back again to work perfectly following the options i gave in my previous post.
my last advice is to learn how to create and use a simple bat file before trying to spin yourself into ‘advanced’ actions.
hoping that you (after 4 years) will consider this post closed :)
Vince
August 26, 2009LOL
I’m not going to dismantle an atomic bomb just cause U2 has a song about it !
kunle
August 26, 2009if you can’t bring up your start menu you could also type “services.msc” in the new task in task manager; this brings up the services dialog
bendodge
August 27, 2009My RPC service turned off once accidentally because of registry corruption. The easiest way to turn it back on is to start a command prompt and type
net start rpcss
That’s all there is to it. If you get an “System Error 5 – Access is Denied” go here
http://www.google.com/search?q=system+error+5+access+is+denied+rpc&pov=117194306921374455719&usg=__ODB5jxmnx-mwQJkoWJpkAYm1PiY=&hl=en
Another note: although the Advanced Tab of the Services MMC snap-in is broken when RPC is off, the simple tab (at the bottom) still works.
Jay
August 29, 2009Hi everyone,
I’ll say this quickly, because obviously whoever wrote this blog is a noob.
DO NOT disable RPC. You have been warned.
Thanks.
ubi
August 29, 2009dear jay.
I’m sorry to disappoint your quick judgement, but saver is not a noob at all.
as he’s been pointing out, this post had a use in may 2005
he was offering an option (not for newbies) to disable RPC and hence overcome the risk of being victim of the above mentioned worm.
a lot of computer and software engineers know how to deal with this stuff and know how to disable RPC or other services without messing up their machines.
if you’re not confident with doing it you should not attempt the trick.
should we warn every kid “not to attempt this at home”?
I don’t think so, but good that you did it.
u
saver
August 30, 2009ok ok you’re right,
I apologize… i will fix it now
DISCLAIMER : don’t try this at home if you are under 8, if you have never seen a pc before or, simply, your don’t know what you’re dealing with.
Jay, i m sorry if you accidentally destroyed your pc following my instructions.
PS : are you guys really still playing with RPC stuff ?
there’s a bunch of more interesting stuff to do out there.
this post is from MAY 2005.
fewiii
August 31, 2009It’s a heckuva lot simpler (and a ton smarter) to just install A/V protection, maybe a software firewall, and/or go to one of the online A/V scanners to deal with malware. I mean, if you have to disable your system to disable malware…..
Pankaj Sharma
August 31, 2009:-) Guys, this just shows how sticky the stuff can be on the Internet! :-)
Raul
September 1, 2009Yeah… yeah! I like this. This has been blowing up which started since time immemorial. More than 4 years and still hot! Just a piece of advice, always be prepared on doing things specially if you are not familiar with. Always have “Plan B” or “C” in case you screwed up. Otherwise, just don’t do it! If your PC is running good, don’t fix it !!!
Kane
September 1, 2009You people that are writing in are all fools. Why the hell would you play in the regrestry if you cannot even make a bat file? Why would you disable a service so important windows doesn’t allow it to be disabled if you don’t know what is going to happen.
I’m sorry mummy the computer is broken – the internet made me do it.
I suggest you all keep out of the regresty. Probably best to keep out of the services. In fact dont go on the internet either.
There are instructions to do all sorts of bad things in a cook book floating around that I wont name for fear of idots. Seasoned users will know it. I’d hate to see you make those things because you can but then not know how to use them at all let alone safely. As for you Saver good on you. You wrote instructions to do something and judging by all the idiots that have written in it works. Your post does exactly what you have said it will.
Tomorrows lessen. How to delete kernel32.dll
Rant over but stupid people piss me off!!
saver
September 1, 2009hi Kane,
i m glad you judged my post exactly with the same mind i had when i wrote it.
i have to say, however, that i do not completely agree with you about people who tried my stuff : i’m sure now some of them can create long and complex bat files to restore their systems in this and a lot of different critical situations :)
the first lesson Internet taught me (the people i met, the forum i read, the ‘tricks’ i learned) is to always be totally aware of what you are going to do.
i admit i forgot to warn people with “do not try this at home” or, at least, explain a way to get the system back to normal state.
anyway, guys, screwing up the system is the first (highest probability) event that can occur if you try something different from cut/copy/save/open commands.
bye
PS : I’m sorry mummy the computer is broken – the internet made me do it. > i m still laughing :D
Mike
September 4, 2009I came, I read, I LOLed.
Bry And Lob
September 6, 2009This post is about to get a whole lot of attention. It was linked to by zdnet.
Link: http://blogs.zdnet.com/BTL/?p=23089
That said, I got a laugh out of some of the comments.
;-)
saver
September 6, 2009good for Larry Dignan,
he wrote a great warning list!!
from my side, i have got a nicest one :
1 Windows Xp action everyone should do : uninstall it.
michael
September 14, 2009This seems like an old article, but for any googler out there:
DO NOT DISABLE THE RPC SERVICE.
This service is critical for the correct functionality of Windows. You won’t need to reinstall your whole system (you can get the service back with net start), but it’s still a stupid idea and doesn’t bring any single benefit at all.
GingerNinja
September 24, 2009Registry is spelt ‘ r e g i s t r y ‘
simplerepair
November 9, 2009just restart under safemode (f8 or f11 at begin of start of the machine)
do the same (services=>RPC,…)
Select “automatic mode” in the RPC service options to reactivate it all depends services(most of windows’s… that’s why ur system doesnt work)
I suppose that this command is aimed to microsoft users who want to leave win’s interface. Kill RPC=>kill (most of) XP…
They want to have their own interface in their microsoft system.
i dont understand why it hasn’t been explained before… => WM ?
Bonehead1
December 30, 2009before you go reinstalling your system over this ..
I have had this service disabled before and resolved the issue successfully in my case terminal services and remote access control was also disabled and in (control_panel\administrative_tools\services ) I was locked out completely from enabling the services listed
to fix the problem i set to default all start values in
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\]
the display name will tell you if you have the right service picked as according to
(control_panel\administrative_tools\services )from in here you can lookup
the start value defaults by right clicking a service and click help
2 for autostart 3 for manual 4 for disable
k then i restarted in safemode command prompt with admin access
ran regedt32 from run menu went to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\]
entered start value of “2″ or autostart
also in my case my start bar was gone so i had to get creative for navigation around the machine the easiest way for me was to right click the desktop and create a folder then i could open the folder to access iexplorer by clearing the text in the navigation bar i could type control panel and hit enter to get to administrative tools
ctrl alt delete will open the task manager from there i could go to file –>new task to get to my run terminal to access regedit.exe and also regedt32
please note it is regedt32 not regedit32
good luck and god bless
oh by the way after your service is started be sure to go back to
control_panel\administrative_tools\services
and enter the correct values in there as well you can do this by selecting the service right click and click properties
BRYAN
January 6, 2010if you do this it will screw up your computer to put things back to normal you have to do the following
reboot your pc with your windows xp install disk
select repair mode once you get to the command prompt type
ENABLE RPCSS SERVICE_AUTO_START
HIT ENTER
TAKE OUT XP CD
REBOOT
SHOULD BE BACK TO NORMAL
saver
January 7, 2010welcome to 2010 guys!
i m afraid i will spend another year reading comments left to this my old old old post.
hoping people will switch to unix based systems, i wish you an happy new year! ;)
.saver.
xileos
June 21, 2010Whoa. Stumbled upon this old post while browsing a Techrepublic document concerning Windows services (specifically RPC). I learned a little bit here and had my LOLs reading these comments. Thanks guys.
Matt
January 22, 2011I was looking for a way to close port 135 because I didn’t like it open, because I didn’t know what it did. I got here via google, I did not come through the front door to this web site and I had no idea who wrote it. I am glad I found this page, and I am glad I read all of the posts before I swallowed the red pill. Saver, maybe you you could put a warning at the top of this page to read all of the page before you try this. Thanks to all for a very entertaining read!
Peter
January 24, 2011Just to pull things straight:
He did post his “Advice” because of:
Quote
Umf.. I hate people (and software) that decide what is good or bad for me”
Unquote
The rest of his excuse is made up.
But I agree, it is plain stupid to disable something u do not hv a clue about; funny part is, Windows itself says right there that more than 2 dozens of other services depend on the RPC.
It’s like switching off the brain, the heart may continue to beat but the higher functions are out of the window(s)…
I came here through google as RPC on my Win7 sys stopped working after installation of Call of Duty Black Ops and I am looking for related info
Daniel Street
February 1, 2012The RPC has always got on my nerves so I decided to follow your advice and disable it.
The result? I couldn’t get back into Windows, so I eventually had to pay a technician £60 to fix it.
Thanks a bunch.
I’m off now to delete the System32 directory – it’s been bugging me for years.