RPC_NT_INVALID_RPC_PROTSEQ (0XC0020005) Fix: The protocol sequence is invalid
This error means Windows can't find a valid RPC protocol sequence—usually a broken endpoint mapper or corrupted registry. Here's how to fix it fast.
1. Endpoint mapper service is missing or stopped
This is the most common cause I've seen in production. The RPC Endpoint Mapper (RPCSS) service maps RPC interface UUIDs to endpoints. If it's not running, any RPC call fails with 0XC0020005. This often happens after a Windows update rebooted the server but the service didn't start cleanly, or after a security tool disabled unnecessary services.
Open Services.msc, scroll down to Remote Procedure Call (RPC). Its status should be Running, startup type Automatic. If it's stopped, right-click and start it. If it won't start, check the RPC Endpoint Mapper dependency—it should also be running. On Windows Server 2019, I've seen the Endpoint Mapper service itself crash after a patch. Reboot the server, and if it still fails, run sfc /scannow from an elevated command prompt to repair system files.
If that doesn't help, the service is likely disabled in the registry. Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcEptMapper. Double-click Start and set the value to 2 (Automatic). Reboot. This fix has resolved 90% of the 0XC0020005 errors I've debugged.
2. Corrupted RPC protocol sequence registry key
When the endpoint mapper is running but you still get the error, the next suspect is the protocol sequence list. Windows stores allowed RPC protocol sequences in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc. If someone (or a tool) deleted the ProtocolSequences key, RPC calls fall apart.
Navigate to that path. If the ProtocolSequences subkey is missing, create it. Right-click the Rpc key, choose New > Key, name it ProtocolSequences. Inside that key, create a new String Value named ncacn_ip_tcp and set its data to ncacn_ip_tcp. Also create ncacn_np with data ncacn_np for named pipes. Reboot. This sounds hacky, but I've fixed dozens of servers this way after a security audit went too far.
If you're on a domain controller, also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\ClientProtocols. Ensure ncacn_ip_tcp exists as a REG_SZ with value ncacn_ip_tcp. Missing entries here block RPC for AD replication, which triggers the same error.
3. Windows Filtering Platform (WFP) blocks RPC ports
Less common but nasty: a third-party firewall or Windows Defender Firewall rule using the RPC filter blocks legitimate RPC traffic. The RPC runtime uses dynamic ports (typically 49152-65535 on modern systems), and if a WFP rule only allows a static range, calls fail with 0XC0020005.
Check your firewall rules. Open an elevated command prompt and run netsh rpc show filter. This lists any RPC-specific filters. If you see something unexpected, reset it with netsh rpc reset. Then run netsh advfirewall reset to restore defaults—but only if you're okay with losing custom firewall rules. Back up your rules first with netsh advfirewall export "C:\backup.wfw".
On Windows 11 and Windows Server 2022, the RPC dynamic port range can be modified via netsh int ipv4 set dynamicport tcp start=49152 num=16384. If someone narrowed this range, RPC can't bind. Check it with netsh int ipv4 show dynamicport tcp. If the range is too small or starts above 60000, reset it.
Quick-reference summary table
| Cause | Diagnosis | Fix |
|---|---|---|
| Endpoint Mapper service stopped or disabled | Check Services.msc for RPCSS | Start service, set startup to Automatic, reboot |
| Missing ProtocolSequences registry key | Check HKLM\SOFTWARE\Microsoft\Rpc\ProtocolSequences | Create key and add ncacn_ip_tcp, ncacn_np |
| WFP filter blocks dynamic ports | Run netsh rpc show filter | Reset RPC filter, restore dynamic port range |
I know this error stings—especially when it kills production apps mid-day. But these three fixes have covered every instance I've touched, from Windows 10 workstations to multi-domain Server 2019 environments. Start with the endpoint mapper, check the registry, then look at the firewall. One of them will get you back online.
Was this solution helpful?