26
May 05How to disable RPC Services on Windows XP
Have you ever thought about disabling RPC (Remote Procedure Calls) on your Windows® XP® Box?
If you tried you might have faced this:
The drop down list for ‘Startup Type’ is disabled and set to ‘Automatic’.
This means we are not allowed to choose any option for this service (including stopping it).
Umf.. I hate people (and software) that decide what is good or bad for me!
Ok..
click Start -> Run
type ‘regedit.exe’ and move to key :
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs]
click twice on the ‘Start’ value (type DWORD) and set ‘Value Data’ to ’4′.
Now open your services list ad select ‘Remote Procedure Call (RPC)’ this is what you’ll witness:
You can finally choose your favorite startup options for this service.
:)
That’s all folks!
by ScL
feat. saver
October 2nd, 2007 at 9:50 pm
After this, desktop main bar doesn’t work. There is just start, but no list of open apps. I have WinXP Pro SP2.
January 9th, 2008 at 1:10 pm
Can you explain the other DWORD entries and what they do, such as ErrorControl, FailureActions, and Type, and under Enum – Count and NextInstance, or, if not, can you post a link with explanations for those? Thank you.
January 10th, 2008 at 1:14 am
WARNING:
Don’t do this! I did this and I it killed my whole system!
January 10th, 2008 at 2:41 pm
i literally had to completely restore my hard drive after this, why would you post how to disable a critical system service?
i had no start bar and i couldnt right click the service to re-enable it, right clicking didnt work.
you should at least post instructions how to re-enable the service through the command prompt.
this page is evil.
January 18th, 2008 at 5:30 am
hello – i tried this and cannot copy or re-enable this service – the properties menu becomes unavailable – im stuck!
January 29th, 2008 at 1:11 am
hi guys,
let’s start from beginning :
when i wrote this post (26th may 2005) a likeable virus called Blaster (see reference on http://www.symantec.com/security_response/writeup.jsp?docid=2003-081113-0229-99)
infected a lot of WinXp machines all around the world.
one of the way to avoid the infection was to install a firewall and the blaster patch before connecting to
the internet for the first time.
if you had not it locally (on cdrom or something else) you were screwed.
so said, an alternative way to do that, was to temporarily stop the RPC service, to fix the system, then activate it again.
Stopping RPC service causes some problems to the regular behaviour of the OS, but it can still work!
the loss of settings of the taskbar is one of these problem, as well the bad display of service panel.
however, you can easily get back to the default settings for the RPC service (once stopped) through regedit.exe
or similar programs that come within your OS, following one of these routes:
1) go to taskmanager->new task and type in the edit box “regedit.exe”
2) create a .bat file and fill it with “regedit.exe” string.then save and launch it.
3) using “reg.exe” (the command_line version of regedit.exe) from cmd
after you have guaranteed access to system registry, simply set back the “Start” value to “2″.
restart the system and everything will get back to normality.
PS : i really don’t know what you meane with “fooled” or “i literally had to completely restore my hard drive” and
“Don’t do this! I did this and I it killed my whole system!”…
simply, don’t play with the system registry if you don’t know exactly what you are doing! :)
and, above all, make always a backup file of the key you are going to edit (File->Export in regedit.exe applcation)
last PS : this trick was useful when blaster was a real security problem (may 2005).
doing this stuff today with you SP2 installed, has no sense.
anyway, i did the trick (on my WinXp Pro Sp2) after reading your comments
and didn’t find any problem in starting the RPC service back.
last advice : if you want your WindowsXP (or Vista) never give you any problem again,
just shutdown your pc, buy a Mac and use OsX :)
saver
February 4th, 2008 at 12:26 am
I read your blog in a regular manner and just love it
hope there will be more postings from you, keep on going
greetz, carmella
April 15th, 2008 at 7:20 pm
Hi Saver
Thanks for trying to help us “dabblers in matters we should leave alone”. I tried everythig you said above and still no joy (still unable to access properties page of rpc service) – tried changing the value to 2 (on the bat key and the start key)restarting on each occasion but still no change.
Could you explain a little more fully about how to create the bat file please and fill it with regedit.exe as I managed to create a key called regedit.exe but I didn’t know how to “Save and launch it”. I’m just reinstalling xp over my current system (which will hopefully retain all my programs/files) but I’d still be interested to know and it may save someone else the 1 hour 30 minutes required to reinstall (probably should have gone for the “repair” option but there ya go…
August 25th, 2009 at 7:50 am
Given all of the shit that breaks when you do that, it seems that preventing someone from disabling RPC is entirely reasonable.
August 26th, 2009 at 10:02 am
Really? You guys are complaining because you tried something that you know nothing about and don’t even know what it does?
If someone wrote a blog about how to hang yourself would you complain to the blogger that you accidentally died?
If you don’t know what it does then why would you even do it in the first place?
August 26th, 2009 at 10:05 am
good comment, richard.
I also have to say that I would thoroughly look at the post date before attempting anything.
many things might have changed since may 26 2005 in matters of RPC etc.
of course saver would be better than me at this, as he wrote the post.
I’m a mac user and don’t even want to know what this does.
August 26th, 2009 at 10:33 am
hi guys,
as i said, this trick was useful to patch WinXp against Blaster worm.
however, Blaster or anything else, playing with registry keys is ALWAYS a dangerous practice.
as most of specialized security weblogs say, is a good behavior to make a system restore point or, at least, data backup before playing with any OS.
i would like to say again that, after reading your comments (“this is evil”, “it killed my whole system” and so on), i did the trick and i was easily able to make WinXp back again to work perfectly following the options i gave in my previous post.
my last advice is to learn how to create and use a simple bat file before trying to spin yourself into ‘advanced’ actions.
hoping that you (after 4 years) will consider this post closed :)
August 26th, 2009 at 2:42 pm
LOL
I’m not going to dismantle an atomic bomb just cause U2 has a song about it !
August 26th, 2009 at 2:56 pm
if you can’t bring up your start menu you could also type “services.msc” in the new task in task manager; this brings up the services dialog
August 27th, 2009 at 4:06 pm
My RPC service turned off once accidentally because of registry corruption. The easiest way to turn it back on is to start a command prompt and type
net start rpcss
That’s all there is to it. If you get an “System Error 5 – Access is Denied” go here
http://www.google.com/search?q=system+error+5+access+is+denied+rpc&pov=117194306921374455719&usg=__ODB5jxmnx-mwQJkoWJpkAYm1PiY=&hl=en
Another note: although the Advanced Tab of the Services MMC snap-in is broken when RPC is off, the simple tab (at the bottom) still works.
August 29th, 2009 at 5:37 pm
Hi everyone,
I’ll say this quickly, because obviously whoever wrote this blog is a noob.
DO NOT disable RPC. You have been warned.
Thanks.
August 29th, 2009 at 5:45 pm
dear jay.
I’m sorry to disappoint your quick judgement, but saver is not a noob at all.
as he’s been pointing out, this post had a use in may 2005
he was offering an option (not for newbies) to disable RPC and hence overcome the risk of being victim of the above mentioned worm.
a lot of computer and software engineers know how to deal with this stuff and know how to disable RPC or other services without messing up their machines.
if you’re not confident with doing it you should not attempt the trick.
should we warn every kid “not to attempt this at home”?
I don’t think so, but good that you did it.
u
August 30th, 2009 at 10:05 am
ok ok you’re right,
I apologize… i will fix it now
DISCLAIMER : don’t try this at home if you are under 8, if you have never seen a pc before or, simply, your don’t know what you’re dealing with.
Jay, i m sorry if you accidentally destroyed your pc following my instructions.
PS : are you guys really still playing with RPC stuff ?
there’s a bunch of more interesting stuff to do out there.
this post is from MAY 2005.
August 31st, 2009 at 5:47 pm
It’s a heckuva lot simpler (and a ton smarter) to just install A/V protection, maybe a software firewall, and/or go to one of the online A/V scanners to deal with malware. I mean, if you have to disable your system to disable malware…..
August 31st, 2009 at 6:40 pm
:-) Guys, this just shows how sticky the stuff can be on the Internet! :-)
September 1st, 2009 at 7:42 am
Yeah… yeah! I like this. This has been blowing up which started since time immemorial. More than 4 years and still hot! Just a piece of advice, always be prepared on doing things specially if you are not familiar with. Always have “Plan B” or “C” in case you screwed up. Otherwise, just don’t do it! If your PC is running good, don’t fix it !!!
September 1st, 2009 at 12:05 pm
You people that are writing in are all fools. Why the hell would you play in the regrestry if you cannot even make a bat file? Why would you disable a service so important windows doesn’t allow it to be disabled if you don’t know what is going to happen.
I’m sorry mummy the computer is broken – the internet made me do it.
I suggest you all keep out of the regresty. Probably best to keep out of the services. In fact dont go on the internet either.
There are instructions to do all sorts of bad things in a cook book floating around that I wont name for fear of idots. Seasoned users will know it. I’d hate to see you make those things because you can but then not know how to use them at all let alone safely. As for you Saver good on you. You wrote instructions to do something and judging by all the idiots that have written in it works. Your post does exactly what you have said it will.
Tomorrows lessen. How to delete kernel32.dll
Rant over but stupid people piss me off!!
September 1st, 2009 at 3:10 pm
hi Kane,
i m glad you judged my post exactly with the same mind i had when i wrote it.
i have to say, however, that i do not completely agree with you about people who tried my stuff : i’m sure now some of them can create long and complex bat files to restore their systems in this and a lot of different critical situations :)
the first lesson Internet taught me (the people i met, the forum i read, the ‘tricks’ i learned) is to always be totally aware of what you are going to do.
i admit i forgot to warn people with “do not try this at home” or, at least, explain a way to get the system back to normal state.
anyway, guys, screwing up the system is the first (highest probability) event that can occur if you try something different from cut/copy/save/open commands.
bye
PS : I’m sorry mummy the computer is broken – the internet made me do it. > i m still laughing :D
September 4th, 2009 at 4:22 pm
I came, I read, I LOLed.
September 6th, 2009 at 1:57 am
This post is about to get a whole lot of attention. It was linked to by zdnet.
Link: http://blogs.zdnet.com/BTL/?p=23089
That said, I got a laugh out of some of the comments.
;-)
September 6th, 2009 at 11:46 am
good for Larry Dignan,
he wrote a great warning list!!
from my side, i have got a nicest one :
1 Windows Xp action everyone should do : uninstall it.
September 14th, 2009 at 3:13 pm
This seems like an old article, but for any googler out there:
DO NOT DISABLE THE RPC SERVICE.
This service is critical for the correct functionality of Windows. You won’t need to reinstall your whole system (you can get the service back with net start), but it’s still a stupid idea and doesn’t bring any single benefit at all.
September 24th, 2009 at 12:38 pm
Registry is spelt ‘ r e g i s t r y ‘
November 9th, 2009 at 4:05 am
just restart under safemode (f8 or f11 at begin of start of the machine)
do the same (services=>RPC,…)
Select “automatic mode” in the RPC service options to reactivate it all depends services(most of windows’s… that’s why ur system doesnt work)
I suppose that this command is aimed to microsoft users who want to leave win’s interface. Kill RPC=>kill (most of) XP…
They want to have their own interface in their microsoft system.
i dont understand why it hasn’t been explained before… => WM ?
December 30th, 2009 at 8:54 pm
before you go reinstalling your system over this ..
I have had this service disabled before and resolved the issue successfully in my case terminal services and remote access control was also disabled and in (control_panel\administrative_tools\services ) I was locked out completely from enabling the services listed
to fix the problem i set to default all start values in
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\]
the display name will tell you if you have the right service picked as according to
(control_panel\administrative_tools\services )from in here you can lookup
the start value defaults by right clicking a service and click help
2 for autostart 3 for manual 4 for disable
k then i restarted in safemode command prompt with admin access
ran regedt32 from run menu went to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\]
entered start value of “2″ or autostart
also in my case my start bar was gone so i had to get creative for navigation around the machine the easiest way for me was to right click the desktop and create a folder then i could open the folder to access iexplorer by clearing the text in the navigation bar i could type control panel and hit enter to get to administrative tools
ctrl alt delete will open the task manager from there i could go to file –>new task to get to my run terminal to access regedit.exe and also regedt32
please note it is regedt32 not regedit32
good luck and god bless
oh by the way after your service is started be sure to go back to
control_panel\administrative_tools\services
and enter the correct values in there as well you can do this by selecting the service right click and click properties
January 6th, 2010 at 8:41 pm
if you do this it will screw up your computer to put things back to normal you have to do the following
reboot your pc with your windows xp install disk
select repair mode once you get to the command prompt type
ENABLE RPCSS SERVICE_AUTO_START
HIT ENTER
TAKE OUT XP CD
REBOOT
SHOULD BE BACK TO NORMAL
January 7th, 2010 at 1:11 am
welcome to 2010 guys!
i m afraid i will spend another year reading comments left to this my old old old post.
hoping people will switch to unix based systems, i wish you an happy new year! ;)
.saver.
June 21st, 2010 at 6:33 pm
Whoa. Stumbled upon this old post while browsing a Techrepublic document concerning Windows services (specifically RPC). I learned a little bit here and had my LOLs reading these comments. Thanks guys.