Fix RPC_NT_ALREADY_LISTENING 0xC002000E Fast

I've seen this error drive people nuts—especially on Windows Server 2016 and 2019. The error code 0xC002000E translates to "the RPC server is already listening." But here's the kicker: the RPC service is not actually running. You restart it, and bam—same error. Let me show you what actually works.

The Fix: Clear Stale Endpoint Mappings

Open an elevated Command Prompt. Right-click Start, choose "Command Prompt (Admin)" or "Windows PowerShell (Admin)."
Stop the RPC service. Type this and press Enter:
```
net stop rpcss
```
You'll see "The Remote Procedure Call (RPC) service is stopping. The Remote Procedure Call (RPC) service was stopped successfully."
Clear stale endpoint mappings. This is the key step. Run:
```
rpcdump.exe /clear
```
If you don't have rpcdump.exe, you can get it from the Windows SDK. On Server 2019, it's in C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x64\ after installing the SDK. Or download the standalone tool from Microsoft. Don't skip this—it's what fixes the "already listening" lie.
Restart the RPC service. Type:
```
net start rpcss
```
You should see "The Remote Procedure Call (RPC) service was started successfully."
Verify. Run this command to check if the error is gone:
```
sc query rpcss
```
Look for STATE: 4 RUNNING. If you see that and no more 0xC002000E when you try to register an endpoint, you're good.

Why This Works

The error is misleading. The RPC service stores endpoint registrations in memory—sort of like a phone book for RPC calls. When a program crashes or a service stops unexpectedly, it doesn't always clean up its entry in that phone book. The next time the RPC service starts, it sees a stale entry and thinks "I'm already listening on that endpoint." Running rpcdump.exe /clear wipes that stale phone book clean. It's like a hard reset for the RPC endpoint mapper.

Less Common Variations

Sometimes the simple fix above doesn't cut it. Here are three less common scenarios I've run into:

1. Port Conflict with Another Service

If you're using a custom port for RPC (like port 135 for the endpoint mapper), another service might have grabbed it. Run netstat -ano | findstr :135 to see what's listening. If it's not the RPC service (PID 4 is often System), you've got a conflict. Change the other service's port, or reconfigure RPC to use a different port range.

2. Dead RPC Endpoint Mapper

On Windows Server 2012 R2, I once had a case where the endpoint mapper service (RpcEptMapper) was in a stopped state but couldn't be started. Check its status with sc query RpcEptMapper. If it's stopped and won't start, run sc start RpcEptMapper. Then do the net stop rpcss and net start rpcss cycle again.

3. Corrupted RPC Registry Entry

This is rare but painful. Open Regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs. Check the ImagePath value—it should be %SystemRoot%\System32\svchost.exe -k rpcss. If it's wrong, fix it. Then restart the service. I've seen malware change this path to point somewhere else, causing the service to fail silently.

Prevention

You don't want to chase this error every week. Here's how to stop it from coming back:

Monitor service crashes. If a service that uses RPC (like SQL Server or Exchange) is crashing, fix that first. Stale endpoints come from unclean shutdowns.
Use the Windows Firewall wisely. Don't block RPC ports dynamically. If you must restrict RPC traffic, set a static port range in the registry (HKLM\SOFTWARE\Microsoft\Rpc\Internet\Ports). Otherwise, let RPC manage its own ports.
Keep your server updated. Microsoft has patched various RPC bugs over the years. A missing update can cause endpoint mapping corruption. Run Windows Update monthly at least.
Restart the RPC service cleanly. If you need to restart it, always stop it first (net stop rpcss) and wait for "stopped successfully" before starting it again. Never kill the process via Task Manager—that leaves stale endpoints.

That's it. The error 0xC002000E is annoying, but it's just a symptom of a dirty endpoint table. Clean it with rpcdump.exe, and you're back in business.