RPC_NT_ZERO_DIVIDE (0XC0020044) fix for Windows Server 2019+

You're running a Windows Server 2019 or 2022 box, everything's stable, then bang — Event ID 1000 with exception code 0xC0020044 (which maps to RPC_NT_ZERO_DIVIDE). The RPC service just died. You dig through the event logs and see the faulting module is RPCRT4.dll. This usually happens when a third-party backup agent, a monitoring tool, or a homegrown RPC client sends a request that includes a calculation where the divisor is zero. I've seen it with a misconfigured SQL Server linked server query and with a dodgy storage management agent.

Why this happens

The RPC runtime (RPCRT4.dll) doesn't validate arithmetic inputs from remote calls. When a client calls an RPC endpoint that performs division — say, calculating a ratio of two counters — and passes a zero as the denominator, the server's RPC thread hits a EXCEPTION_INT_DIVIDE_BY_ZERO. The kernel catches it and translates it to STATUS_INTEGER_DIVIDE_BY_ZERO, which surfaces as RPC_NT_ZERO_DIVIDE. That's the machine version of a crash.

What's actually happening here is that the RPC server doesn't wrap the division in a try/except block. Microsoft's stance is that the calling code should sanitize its inputs — but that doesn't help you when you're stuck with a black-box vendor app. The fault is always on the endpoint that performs the arithmetic, not the transport layer.

The fix — block or patch the endpoint

You have three options. Pick the one that fits your tolerance for downtime and vendor cooperation.

Option 1: Identify and block the offending client (quick fix)

1. Open Event Viewer and look for the crash event. It'll have the faulting module as RPCRT4.dll and an exception code 0xC0020044. Note the timestamp.
2. Run wevtutil qe System /q:"*[System[(EventID=1000)]]" /rd:true /c:1 /f:text to pull the full event XML. Look for the FaultingApplicationName or FaultingProcessId.
3. Use netstat -ano | findstr :135 to list active RPC connections. Cross-reference the process ID from step 2 with the PID in netstat output. That's your offender's IP.
4. If the client is a known third-party tool (e.g., Veeam agent, SolarWinds, or a custom app), temporarily block its IP via Windows Firewall: New-NetFirewallRule -DisplayName "Block RPC offender" -Direction Inbound -LocalPort 135 -RemoteAddress 192.168.1.100 -Protocol TCP -Action Block. Replace the IP with the one you found.
5. Restart the RPC service: net stop RpcSs && net start RpcSs. The server should recover. If the crash stops, you've found your culprit.

Option 2: Patch the calling code (if you control the client)

1. Find the RPC client source code that sends the request with a zero divisor. Look for any Send or Call to an RPC endpoint that passes integer parameters used in a division.
2. Wrap the division on the server side (or client side) in a try/except block. In C++, that's __try { result = a / b; } __except(EXCEPTION_EXECUTE_HANDLER) { result = 0; }. In C#, use try { result = a / b; } catch (DivideByZeroException) { result = 0; }.
3. Also validate the divisor before the call: if (b == 0) { return E_INVALIDARG; }. This prevents the exception entirely.
4. Recompile and redeploy. Test with a zero input to confirm no crash.

Option 3: Apply a hotfix or workaround from the vendor

1. Search for your vendor's KB article using the error code 0xC0020044. Microsoft released a hotfix for this on Server 2019 for some RPC proxy scenarios (KB5005112). If it's a Microsoft component, install the latest cumulative update.
2. For third-party apps, check their release notes for a fix mentioning "RPC divide by zero" or "exception code 0xC0020044". Update the app.
3. If no fix exists, use Option 1 as a permanent firewall rule until the vendor patches it.

What to check if it still fails

If the crash persists after blocking the suspected client, you've got multiple offenders. Run tcpdump -i any port 135 (install Wireshark or use Microsoft Network Monitor) and look for RPC BIND requests from unexpected IPs. Also check if a local service is calling itself — sometimes a misconfigured Windows service (like Hyper-V or Failover Clustering) triggers the divide internally. In that case, disable the suspect service temporarily to isolate it.

One more thing: if you're on a domain controller, don't blindly block port 135 from all clients — you'll break authentication. Instead, use netsh rpc filter add rule to create an RPC-specific filter. Here's a quick one: netsh rpc filter add rule layer=lu authlevel=6 remotename=offending_host. That only blocks RPC calls from that host.