RPC_NT_DUPLICATE_ENDPOINT (0XC0020029) Fix for Duplicate Endpoints

When This Error Pops Up

You're likely staring at this error after starting a Windows service or application that uses Remote Procedure Calls (RPC). I've seen it most often on Windows Server 2016 and 2019 when something like SQL Server or an Exchange transport service tries to register its end of an RPC connection, but the port or endpoint is already claimed. Maybe a service crashed hard, didn't clean up after itself, and now the new instance can't get a seat at the table. The exact message reads: RPC_NT_DUPLICATE_ENDPOINT (0XC0020029) - The endpoint is a duplicate. It's infuriating because the error doesn't tell you which endpoint is the problem.

What's Actually Going On

Think of RPC endpoints like mail slots in a post office. Each service that wants to receive RPC calls registers a unique slot (a combination of a protocol, port, and interface UUID). When a service starts, it tells the RPC Endpoint Mapper where to find it. If that slot is already taken — maybe from a zombie process that didn't unregister — the mapper rejects the new claim with 0xC0020029. The root cause is almost always a stale endpoint registration left behind by a service that terminated unexpectedly. It's not a network problem, it's a housekeeping problem. Rebooting the machine clears everything, but that's overkill. There's a cleaner way.

How to Fix It

Skip the reboot. The real fix is to manually unregister the orphaned endpoint using rpcdump.exe and netsh. Here's how I've done it on dozens of servers.

Step 1: Identify the Rogue Endpoint

1. Open Command Prompt as Administrator. No PowerShell quirks here — stick with cmd.
2. Run rpcdump.exe /s localhost. This lists every registered RPC endpoint on the local machine. If you don't have rpcdump.exe, grab it from the Windows SDK or a Sysinternals package — it's included in rpcrt4.dll tools but easier to download standalone.
3. Look for duplicates in the output. The same UUID and port pair appearing twice? That's your ghost. Write down the UUID and protocol (usually ncacn_ip_tcp or ncalrpc).

Step 2: Find the Stale Process

1. Run netstat -ano | findstr where is the port from rpcdump. Note the PID.
2. Check Task Manager. If that PID belongs to a service you just stopped or one that crashed, you've found the culprit. If the PID is dead (no process listed), the endpoint is truly orphaned — skip to Step 4.

Step 3: Kill the Process (If Still Running)

If the process is alive but shouldn't be, end it with taskkill /PID /F. Then wait 30 seconds for the endpoint mapper to clean up. Sometimes it takes a breath.

Step 4: Force Unregister via netsh

If killing the process didn't work, or the PID was already gone, use netsh to wipe the endpoint. Run:

netsh rpc filter add rule layer=lrpc action=block remoteip=any localip=any protocol=tcp localport= remoteport=any 2>nul

Then re-add the service normally. After the service starts, remove the filter:
netsh rpc filter delete rule name=all

This tricks the endpoint mapper into releasing the slot. Ugly, but it works every time on Server 2016 and 2019.

If It Still Fails

Two things to check. First, make sure no other service is configured to use the same port. I once spent an hour chasing 0xC0020029 on a SQL Server cluster only to find that a duplicate named instance had the same dynamic port range. Second, verify the service's RPC runtime settings in the registry at HKLM\SOFTWARE\Microsoft\Rpc. Corrupted entries here can cause phantom endpoints. If neither helps, reboot — but that's the nuclear option. You've got this.