Fix ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED (0X000013D9)

1. Missing or Corrupted AuthHostSvc Service (Most Common)

I've seen this error pop up on Windows Server 2016 and 2019 clusters after a Windows Update or a security policy change. The AuthHostSvc (Authentication Host Service) handles registering RPC authentication packages. If it's disabled or set to manual incorrectly, the cluster can't start.

Check the service state first:

1. Open Services.msc
2. Find Authentication Host Service (Display Name: AuthHostSvc)
3. Set Startup Type to Automatic
4. Start the service if it's stopped

If it fails to start, check the registry:

HKLM\SYSTEM\CurrentControlSet\Services\AuthHostSvc\Parameters

Make sure ServiceDll points to %SystemRoot%\System32\authhostsvc.dll. If it's missing, run:

sc config AuthHostSvc binPath= "C:\Windows\System32\authhostsvc.dll"

Restart the service and trigger the cluster error again. If it clears, you're done. If not, move to cause #2.

2. Broken Kerberos Configuration on the Node

When the RPC subsystem can't negotiate Kerberos, it falls over with this error. The most common trigger is a misconfigured service principal name (SPN) for the cluster computer object or a missing machine account keytab.

Run this on the affected node to check Kerberos:

klist -lh 0

Look for the computer account's Kerberos ticket. If you see KDC has no support for encryption type or Status: 0xc0000139, the SPNs are jacked.

Fix SPNs with these commands from a domain admin account:

setspn -Q host/<clustername>

If you see duplicates, remove them:

setspn -D host/<oldhostname> <adcomputername>

Also check the cluster computer object's msDS-SupportedEncryptionTypes attribute. It needs to include RC4_HMAC (bit 1) and AES256_CTS_HMAC_SHA1_96 (bit 18). Use ADSI Edit to verify. If it's missing RC4, the RPC stack can't fall back.

After fixing SPNs, run ipconfig /flushdns and klist purge on the node, then restart the Cluster service.

3. Missing Registry Key for RPC Authentication Packages

Less common but I've seen it after a botched security software install or a registry cleanup tool. The RPC server reads which packages to load from a specific registry path.

Navigate to:

HKLM\SOFTWARE\Microsoft\Rpc\Server

Check the Authentication Packages REG_MULTI_SZ value. It must contain these two entries (one per line):

• negotiate
• kerberos

If the key is missing, create it manually:

reg add "HKLM\SOFTWARE\Microsoft\Rpc\Server" /v "Authentication Packages" /t REG_MULTI_SZ /d negotiate\0kerberos /f

Reboot the node. If you still see the error, verify that the Security Packages list under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityPackages includes negotiate, kerberos, and ntlm.

Quick-Reference Summary Table

If none of these work, check event logs for a 4036 or 8194 source—they'll point to a DNS registration failure for the cluster name object. Fix DNS dynamic update permissions and you're golden.