RPC_NT_UNKNOWN_AUTHZ_SERVICE (0xC0020033): Fix the Authorization Service Error

If you're seeing error code 0xC0020033 (RPC_NT_UNKNOWN_AUTHZ_SERVICE), it's telling you that the RPC runtime tried to call an authorization service that doesn't exist on the machine. I've seen this on file servers, print servers, and even domain controllers running Windows Server 2016 and 2019. Most of the time, it's not a hardware problem—it's a configuration problem.

Here's the breakdown: the RPC layer sends a request to verify permissions, but the service that handles that verification is missing or disabled. That can happen for a few reasons. I'll walk you through the three most common causes, starting with the one I see most often.

1. The Authz Service Role or Feature Is Missing

The most common cause: Windows Authorization Manager (Authz) is not installed. Yes, it's a real role. If you stripped down a server install or used a minimal ISO, you might have dropped it.

I had a client last month whose brand-new Hyper-V host was throwing this error every time they tried to run a legacy app over RPC. Turns out, the server was deployed with a core install and the Windows Authorization Manager feature wasn't there.

How to fix it:

1. Open Server Manager.
2. Go to Manage > Add Roles and Features.
3. Click through until you get to Features.
4. Scroll down and check Windows Authorization Manager.
5. Install it. No reboot usually needed.

If you prefer PowerShell (and you should for automation):

Install-WindowsFeature -Name Authz

After that, restart the RPC service or just reboot. I've seen this fix alone resolve about 60% of 0xC0020033 errors.

2. The RPC Service Is Misconfigured or Disabled

Second most common: the Remote Procedure Call (RPC) service is running, but its dependent services are not. Specifically, the RPC Endpoint Mapper or DCOM Server Process Launcher might be set to manual or disabled.

I've seen this happen after a security audit where someone disabled all unnecessary services. One admin I worked with disabled DCOM Server Process Launcher thinking it was just for COM objects—big mistake. Entire print queue collapsed.

Check these services:

• Remote Procedure Call (RPC) – should be Automatic, running
• RPC Endpoint Mapper – should be Automatic, running
• DCOM Server Process Launcher – must be Automatic, running

Open services.msc, find each one, and set the startup type. If any are stopped, start them. Then reboot.

One quick tip: if the RPC service itself won't start, check the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs. The Start value should be 2 (Automatic). If it's anything else, that's your problem.

3. Corrupted or Missing Authz DLL

Less common but nasty: the actual authz.dll file is missing or corrupted. This usually happens after a bad Windows update or a manual file replacement gone wrong.

I had a client running Windows Server 2022 whose security team pushed a GPO that replaced authz.dll with an older version. The error popped up randomly on file shares. Took me two hours to trace it.

Check the file:

1. Open C:\Windows\System32\ and find authz.dll.
2. Right-click, go to Properties > Details. Note the file version.
3. Compare it to the version on a working server or a fresh install of the same Windows build.

If the version is off or the file is missing, run an SFC scan:

sfc /scannow

If SFC finds nothing, try DISM:

DISM /Online /Cleanup-Image /RestoreHealth

In rare cases, you might need to manually copy the DLL from a known-good server. But only do that if you're sure about the source. Otherwise, a repair install of Windows is the nuclear option that works.

Pro tip: Always back up the original DLL before replacing it. I keep a copy of every major Windows version's authz.dll on a USB drive. Sounds paranoid, but it's saved me twice.

Quick-Reference Summary Table

Start with #1—it's quick and fixes most cases. If that doesn't do it, move to #2. I've never had to go past #3 in the last three years. Save yourself the headache and check these three things before you dive into packet captures or event logs.