RPC_S_SEC_PKG_ERROR (0x00000721) — Real Fixes from the Field

What Actually Triggers 0x00000721

You're trying to connect to a remote server, maybe a domain controller for a print job, or running a PowerShell command against an Exchange server, and you get hit with RPC_S_SEC_PKG_ERROR (0x00000721). Translates to: "A security package-specific error occurred." In plain English, the machine you're connecting to doesn't trust the authentication method you're using. It's almost always a mismatch between what the client sends and what the server expects for NTLM or Kerberos.

Had a client last month whose entire print queue died because of this. Their printer server couldn't authenticate to the domain controller after a Windows update rolled out. The event log was full of 0x00000721 errors. Took me 20 minutes to trace it back to a missing NTLM setting.

1. NTLM Authentication Blocked or Misconfigured

The most common cause. Windows Server (especially 2016/2019/2022) has Group Policy settings that restrict NTLM authentication. When a client tries to connect using NTLM and the server doesn't allow it, you get this error. The fix is usually on the server side, not the client.

Check NTLM Settings via Group Policy

1. On the server receiving the RPC call, open gpedit.msc (Local Group Policy Editor) or check domain Group Policy management.
2. Go to: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
3. Find Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers. If it's set to "Deny All" or "Deny Domain Servers," change it to "Allow All" or set it to "Not Defined."
4. Also check Network security: Restrict NTLM: NTLM authentication in this domain. If it's set to "Deny Domain Servers," that's your problem. Change to "Not Defined" or "Deny for domain accounts to domain servers" (but only if you know what you're doing).
5. Reboot the server or run gpupdate /force in an admin command prompt.

Quick Test with Regedit

If you can't change GPO immediately, you can check the registry directly:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

Look for these DWORD values:

• RestrictNTLMOutboundNTLM — should be 0 (default). If it's 1, 2, or 3, NTLM outbound is restricted.
• RestrictNTLMInDomain — should be 0. If it's 2, NTLM is denied for domain servers.

Change them to 0 and reboot. That fixes a lot of 0x00000721 errors.

2. Kerberos Ticket Expired or Corrupted

Second most common cause. The RPC server expects a Kerberos ticket, but the client's ticket is expired, corrupted, or just missing. This happens after a long uptime, a time sync drift, or when the computer account password gets out of sync with the domain controller.

Flush and Renew Kerberos Tickets

On the client machine where the error shows up, run these commands from an admin command prompt:

klist purge -li 0x3e7
klist purge
klist get krbtgt

The first command purges the computer account's tickets. The second clears user tickets. The third forces a fresh ticket-granting ticket.

If that doesn't work, check time sync. Kerberos is strict about time — if the client and server clocks differ by more than 5 minutes, tickets get rejected. Run w32tm /resync on both sides, or point to the domain controller for NTP.

Reset the Machine Account Password

For a stubborn case, reset the computer's AD account password. On the client, run an elevated PowerShell and do:

Reset-ComputerMachinePassword -Credential (Get-Credential)

Enter domain admin credentials when prompted. Reboot after it completes. This forces a fresh Kerberos trust with the domain.

3. Corrupted RPC Configuration or Missing Registry Keys

The less common but annoying cause. The RPC subsystem itself is hosed. This can happen after a failed Windows update, a security software uninstall, or some overzealous registry cleanup tool.

Restore Default RPC Registry Keys

On the server showing the error, open Regedit and go to:

HKLM\SYSTEM\CurrentControlSet\Services\RpcSs
HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper

Make sure these keys exist. If they're missing, you can export them from a working machine (same OS version) and import them. Or manually create them:

• RpcSs — DWORD Start = 2 (Automatic), Type = 0x20, ObjectName = NT Authority\NetworkService
• RpcEptMapper — DWORD Start = 2, Type = 0x20, ObjectName = NT Authority\NetworkService

Reboot after.

Re-register RPC DLLs

Open an admin command prompt and run:

regsvr32 rpcrt4.dll
regsvr32 rpcss.dll
regsvr32 RpcProxy.dll

Ignore any "already loaded" messages. Reboot.

Had a client last month whose antique line-of-business app suddenly threw this error after a Windows 10 feature update. None of the GPO stuff worked. Re-registering these DLLs fixed it immediately. Go figure.

Quick-Reference Summary Table

Start with cause #1 — it's the most common by far. If you're dealing with a domain-joined server, check the GPO first before chasing Kerberos tickets. For standalone machines, skip to cause #3 after verifying NTLM isn't blocked.