Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Restrict Unauthenticated RPC clients

This `REG_DWORD` value determines whether the RPC server runtime performs additional authentication checks on incoming remote calls across the system.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Policies\Microsoft\Windows NT\Rpc\RestrictRemoteClients

This REG_DWORD value determines whether the RPC server runtime performs additional authentication checks on incoming remote calls across the system. The check also applies to RPC interfaces that have not registered their own security callback.

The value data has the following meanings:

  • 0 (RPC_RESTRICT_REMOTE_CLIENT_NONE): The RPC server runtime bypasses this additional check. RPC applications can still enforce their own authentication and authorization requirements.
  • 1 (RPC_RESTRICT_REMOTE_CLIENT_DEFAULT): Remote unauthenticated calls are generally rejected. Calls using named pipes (ncacn_np) and interfaces registered with RPC_IF_ALLOW_CALLBACKS_WITH_NO_AUTH are exempt.
  • 2 (RPC_RESTRICT_REMOTE_CLIENT_HIGH): Remote unauthenticated calls are rejected without exemptions.

When the value is 1 or 2, the RPC Endpoint Mapper interface is no longer anonymously accessible. Clients that initially query the Endpoint Mapper anonymously for a dynamic RPC endpoint can therefore fail before reaching the intended RPC interface.

Notes

Security

Values 1 and 2 reduce the RPC attack surface exposed to anonymous remote clients. This can prevent unauthenticated access to vulnerable RPC interfaces, including interfaces that could otherwise expose remotely exploitable flaws.

Value 1 retains specific compatibility exceptions. Value 2 removes those exceptions and applies the stronger restriction, but it can disrupt substantially more RPC-dependent functionality. This setting does not replace application-specific authorization of authenticated clients.

Possible side effects

The restriction affects every RPC application on the computer. Applications that depend on anonymous remote calls, as well as some DCOM functionality, might stop working. RPC calls over connectionless protocol sequences such as ncadg_ip_udp and ncadg_ipx are treated as insecure and fail while the restriction is enabled.

In domain environments, the setting can interfere with functions including Group Policy processing and Active Directory replication. Microsoft therefore states that it should never be applied to a domain controller. A restrictive value can also prevent the affected computer from receiving a subsequent domain policy change that would reverse the setting.

Notes

A system restart is required before a change to this value takes effect.

An absent value does not necessarily have the same effect as explicitly setting 0 on every Windows product type. For the corresponding policy, supported Windows client systems use the “Authenticated” behavior by default, while supported Windows Server systems use “None.” An explicit registry value should therefore not be treated as equivalent to an unconfigured policy.

Microsoft documentation

Microsoft Learn: RPC Interface Restriction

Microsoft Learn: RemoteProcedureCall Policy CSP

See also