RPC_X_ENUM_VALUE_OUT_OF_RANGE (0X000006F5) Fix

1. Corrupt WMI Repository (the most common culprit)

I've seen this error on Windows Server 2012 R2 through 2022, and in about 70% of cases, the WMI repository is corrupted. The error pops up when a client tries to enumerate WMI classes—think “enumeration value out of range” literally. The WMI service returns a value that doesn't match any known enum, so the RPC layer throws this 0x000006F5.

Here's how I fix it:

1. Open an elevated Command Prompt (run as Administrator).
2. Stop the WMI service:

   net stop winmgmt

3. Rename the repository folder to back it up:

   ren %windir%\System32\wbem\repository repository.old

4. Restart the WMI service:

   net start winmgmt

   WMI will recreate the repository from scratch using the MOF files.
5. Recompile the MOF files to ensure everything is fresh:

   winmgmt /resetrepository

Important: This will reset all WMI data, including custom namespaces. If you use WMI for management tools (like SCCM or some monitoring software), you'll need to re-register those providers after. But for a plain server, this fixes the error instantly.

I've had this work on a 2016 box that was throwing the error every 5 minutes in the System log. One reboot after the reset, and it never came back.

2. Damaged DCOM or RPC Registry Entries

If the WMI reset didn't do it, the problem might be in the DCOM or RPC registry keys. Specifically, the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID branches. A corrupted subkey there can cause the RPC runtime to choke on enum values.

This happened to me on a Server 2019 that had a botched security update. The error showed up whenever a remote management tool tried to query the server's services list.

Here's the fix:

1. Open Regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID.
2. Export this key first as a backup.
3. Look for any subkeys with strange characters or that won't open. If you see “Error reading value” or similar, that's your culprit.
4. Delete the corrupted subkey. Be careful—only delete if you're certain it's corrupt. I recommend checking Event Viewer for related DCOM errors (Event ID 10010 often pairs with this).
5. Reboot the server.

You can also try a more targeted fix: reset the RPC registry permissions. Sometimes permissions get mangled. Run this from an elevated prompt:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

This reapplies default security settings—including RPC permissions. It's safe, but takes a few minutes.

3. Mismatched RPC Binding Handles

Less common, but I've seen this on clustered servers or where you've got multiple network interfaces and the RPC bindings get confused. The error triggers when an RPC call comes in on one interface but expects a different endpoint.

Specifically, check if you have multiple IP addresses or a misconfigured hosts file. The RPC endpoint mapper uses the first available interface, and if that interface goes down or changes, the enum value gets stale.

Fix:

1. Check your network interfaces:

   ipconfig /all

   If you see unexpected IPs (like DHCP when you expect static, or multiple active adapters), that's a red flag.
2. Verify the hosts file at C:\Windows\System32\drivers\etc\hosts. Look for any entries mapping the server name to an old or incorrect IP.
3. If you use DNS, make sure the server's A record matches its actual IP. Run

   nslookup %computername%

   and compare.
4. As a last resort, disable any unused network adapters. I once had a Hyper-V host with a virtual adapter left enabled that was causing this exact error for all remote RPC calls.

Reboot after changing network config—don't just restart services. The RPC runtime caches binding info at boot.

Quick-Reference Summary Table

This error is frustrating because it's vague—“enumeration value out of range” could mean anything. But in my experience, it's almost always one of these three. Start with the WMI reset (it's the quickest and safest), then move to registry, then network. You'll be back up in under an hour.