Fix RPC_S_PRF_ELT_NOT_ADDED (0X00000786) Profile Element Error

1. Registry Permissions Are Locked Down

The culprit here is almost always a permissions issue on the RPC registry keys. Specifically, the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc key or its subkeys got restrictive ACLs — maybe from a security hardening template or a botched Group Policy application.

You'll see this error in the System event log, Event ID 0x786, usually when an RPC endpoint mapper call fails. I've seen it most often on Windows Server 2016 and 2019 after applying the Microsoft Security Compliance Toolkit.

Fix: Restore Default Registry Permissions

1. Open Regedit.exe as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc.
3. Right-click Rpc, choose Permissions.
4. Make sure SYSTEM and Administrators have Full Control. Users and NETWORK SERVICE should have Read.
5. Click Advanced, then check the Replace all child object permission entries checkbox. Apply and OK.
6. Restart the RPC Endpoint Mapper service (RpcEptMapper) — or just reboot.

Don't bother with the Everyone group unless you're desperate. That rarely helps and opens security holes.

2. Corrupted RPC Performance Counters

Another common trigger: the RPC performance counters got corrupted or the counter DLL isn't registered correctly. This happens after a .NET Framework update or an incomplete Windows patch cycle. The error text says "profile element could not be added" because the RPC service can't load the counter definition string from the registry.

Fix: Rebuild Performance Counters

Run these commands in an elevated Command Prompt (Windows 10/11 and Server 2016+):

lodctr /R
cd \windows\system32
lodctr /e:PerfProc
lodctr /e:PerfOS

The /R flag rebuilds all counter strings from backup. If you're on Server 2012 R2 or older, you might need to manually unregister and re-register the RPC counter DLL:

unlodctr RPC
lodctr rpcctrs.ini

But honestly, lodctr /R fixes this in 95% of cases. After running it, wait 30 seconds and then restart the RPC Endpoint Mapper service. Check the event log — the error should stop.

3. RPC Service Not Starting Due to Dependency Issues

Sometimes the RPC service itself fails to start because a dependency — like the Remote Procedure Call (RPC) Locator or the DCOM Server Process Launcher — is disabled or stuck. This is rarer, but I've seen it on servers where an admin disabled services thinking they were "unnecessary."

You'll see this error alongside Event ID 7023 (service terminated with error) in the System log.

Fix: Verify RPC Service Dependencies

Open Services.msc and check the Remote Procedure Call (RPC) service. Its Start-up type should be Automatic and the service status Running. The dependencies list should include:

• DCOM Server Process Launcher (start-up type: Automatic)
• RPC Endpoint Mapper (start-up type: Automatic)
• Plug and Play (start-up type: Automatic)

If any dependency is set to Disabled or Manual, change it to Automatic and start the service. Then restart the RPC service itself. If you can't start it from the GUI, use this command:

sc start RpcSs

Skip trying to modify service dependencies via registry unless you're comfortable with recovery console. The GUI is safer here.

Quick-Reference Summary Table

If none of those work, you're probably dealing with a corrupted OS image. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth — but I've only needed that once in 14 years. Nine times out of ten, it's the registry permissions.