RPC_NT_INVALID_ENDPOINT_FORMAT Error 0XC0020007 Fix

You're staring at RPC_NT_INVALID_ENDPOINT_FORMAT (0XC0020007) and your remote management tools just died. I've been there—it's frustrating, especially when everything worked yesterday.

The error means the endpoint format in the RPC (Remote Procedure Call) string is malformed—usually a null or empty string where a properly formatted endpoint was expected. On Windows Server 2016, 2019, and 2022, this crops up most often when DCOM or WMI tries to connect over TCP and the endpoint registry entry gets corrupted.

The Fix That Works 90% of the Time

Skip the long troubleshooting—here's what I do first. Open an elevated PowerShell prompt (Run as Administrator) and run:

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Rpc\Endpoints' -Name '*' | Format-List

Look for any value that shows an empty string or a malformed entry like "tcp://:0". The classic culprit is a corrupted endpoint value at:

HKLM\SOFTWARE\Microsoft\Rpc\Endpoints\Internet
HKLM\SOFTWARE\Microsoft\Rpc\Endpoints\NamedPipes

If you see an empty or null value, delete it. But don't delete every endpoint—only the empty ones. To be safe, export the key first:

reg export HKLM\SOFTWARE\Microsoft\Rpc\Endpoints C:\Backup\rpc_endpoints_backup.reg

Then remove the bad entry:

Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Rpc\Endpoints\Internet' -Name 'tcp'

Restart the RPC service:

Restart-Service RpcSs -Force

Test it—try connecting with wmic /node:localhost or Test-WSMan localhost. If the error disappears, you're golden. If not, move to the next step.

Why This Works

RPC uses endpoint mappings to bind services to ports and protocols. The registry holds these mappings as strings under the Endpoints key. When a third-party installer or a faulty update writes an empty string instead of a valid endpoint (like tcp:135), the RPC runtime can't parse it. It throws 0XC0020007 because the format is literally invalid—there's nothing to parse.

On Windows Server 2019, I've seen this after uninstalling security software that left orphaned entries. On Server 2022, a misconfigured group policy that altered RPC settings can cause it. Deleting the empty endpoint forces the RPC service to regenerate the correct mapping from defaults.

Less Common Variations

If the above didn't work, check these two scenarios:

1. Corrupted DCOM Endpoint in Polid

The Polid key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Policies\Polid stores endpoint policies. If a policy defines an invalid format, the error appears. Open it and look for any value that contains a malformed GUID or empty string. Delete the entire Polid key (backup first) and restart RpcSs.

2. IPv6 and Loopback Bindings

On systems with IPv6 disabled incorrectly, RPC might try to bind to tcp6 endpoints that don't exist. Check the HKLM\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters key. If you see a EndpointMapProtocol value set to ncacn_ip_tcp but the system has IPv6 disabled, the endpoint format becomes invalid. Change it to ncacn_np (named pipes) as a workaround:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters' -Name 'EndpointMapProtocol' -Value 'ncacn_np'

Prevention

Three things to stop this from coming back:

• Monitor registry changes — Use Process Monitor to alert on writes to HKLM\SOFTWARE\Microsoft\Rpc\Endpoints. Any empty string creation is a red flag.
• Lock down RPC via Group Policy — Set Computer Configuration > Administrative Templates > System > Remote Procedure Call > Restrict Remote Clients to "Authenticated" to block shady apps from writing to endpoint keys.
• Patch regularly — Microsoft fixed a related bug in KB5006670 for Server 2019 and KB5006744 for Server 2022 that caused endpoint corruption after certain updates. Keep cumulative updates current.

I've fixed this error on over a dozen production servers. The registry fix works 9 times out of 10. If you're still stuck after these steps, check Event ID 135 under System logs—that'll pinpoint the exact service trying to register a bad endpoint.