Fix RPLUSER 0X00000A36: RplNotRplServer group missing on Server

Before you start

The error 0X00000A36 with message NERR_RplNotRplServer means the Windows NT Remote Boot service (RPLUSER) can't find the RPLUSER group in the local SAM database. This group must exist for the service to start. You'll see this most often when you've restored a server from backup but skipped the SAM hive, or after a domain migration where the local RPLUSER group got stripped.

Skip the steps you don't need. Stop when the service starts cleanly.

1. The 30-second fix: Create the RPLUSER group with net localgroup

Open an elevated command prompt (Run as Administrator). Type:

net localgroup RPLUSER /add

You should see The command completed successfully. Now check if the RPLUSER service starts:

sc start RPLUSER

Or restart the server if the service is set to auto-start. If it works, you're done. If you get System error 1332 or The group name could not be found, move to step 2.

Why this works: The SAM database expects a group SID with the well-known alias RID 0x00000A36. The net localgroup command creates that group and assigns a fresh SID. The RPLUSER service checks for the group's existence by SID, not by name. If the SAM is intact, this is all you need.

2. The 5-minute fix: Repair the SAM using the Recovery Console or ERD

If step 1 fails, the SAM database itself is corrupted or missing the RPLUSER group's account record. You need to restore or rebuild the SAM.

Boot from a Windows Server 2003/2008 installation disc into the Recovery Console. At the command prompt, run:

fixboot
copy C:\Windows\Repair\SAM C:\Windows\System32\config\SAM

This overwrites the current SAM with the backup from the \Repair folder. That backup includes the built-in groups like RPLUSER. Reboot and test the service.

Warning: This replaces all local user accounts and groups with the ones from the original install. You'll lose any accounts you added after the OS was installed. If you have custom local accounts, back them up first with net user exports.

If you don't have a disc, use a third-party tool like ERD Commander (part of the old AdminPak) to mount the SAM and add the missing group record manually. But honestly, the copy from Repair is faster and less error-prone.

3. The 15+ minute fix: Manual SAM repair with regedit offline

This is your last resort. You'll edit the SAM hive directly. It's risky, so take a full backup of C:\Windows\System32\config first.

Boot from a Windows PE environment (or another OS). Load the SAM hive into RegEdit:

1. Start regedt32.exe (the 32-bit version on PE).
2. Select HKEY_LOCAL_MACHINE, then File → Load Hive.
3. Navigate to C:\Windows\System32\config\SAM and load it as OfflineSAM.
4. Browse to OfflineSAM\SAM\Domains\Account\Groups\Names.
5. Look for a key named RPLUSER. If it's missing, you need to create it.

Create a new key named RPLUSER under Names. Set its default value (REG_NONE) to a zero-filled binary. Then, in the parent Groups key, create a key with the RID 00000A36. This part requires copying an existing group's binary data (like Administrators with RID 000001F4) and adjusting the RID field. It's tedious and easy to mess up.

My honest take: Skip this unless you're a domain admin with nothing to lose. The copy-from-Repair method (step 2) is safer. If you must do this, use a tool like chntpw instead — it has a -l option to list and add local groups. Boot a Linux live CD, mount the NTFS volume, and run:

chntpw -l SAM

Then use chntpw -u RPLUSER SAM to add the group. The tool handles the binary structures correctly.

Verification

After any fix, check the service status:

sc query RPLUSER

It should show STATE as RUNNING. Also test that Remote Boot clients can connect. If the service starts but clients fail, the group's SID might not match what the service expects. In that case, run sc delete RPLUSER then sc create RPLUSER ... to re-register the service, and reboot.

If none of this works, consider that the RPLUSER service was never part of your SKU — it's only present on Windows Server 2003/2003 R2 and 2008 (not 2008 R2 or later). On newer systems, install the Remote Boot feature via Server Manager.