We help IT Professionals succeed at work.

The Remote Procedure Call (RPC) service terminated unexpectedly.

Last Modified: 2013-11-21
I have a server computer with Windows 2000 Server Family which shows an error begining with the question title, The Remote Procedure... etc, etc.
The machine shuts down in one minute and loops in this fashion indefinitely.

I have searched solutions in this site, but all the ones I have found assume that one is able to boot the computer successfuly, or have enough time to abort the shutdown, disable the RPC service, and download the security patch from Microsoft.

I do not have enough time to perform the fix suggested because the system only gives me a one-minute window. I have not been able to logon yet. Not normally, not Safe Mode, nothing.

Please let me know if have any ideas as to stop the looping and restoring the system to its normal condition.

Thank you very much,

Watch Question

Hello snafix, try this: Insert your OS installation disc into the cd drive and start computer,  When install wizard shows up select 'Repair'. You might have a virus ( the old Netsky.Q worm instigated RP shutdown). After repair is finished, reboot into safe mode, hold down (F8) key during boot. If it succesfully boots then run a virus scan. If it doesn't fix problem do a System Restore to a point previous to problem occuring..(assuming you can get to safe mode screen). Let me know if this works, I will research new virus's and see what fix procedures are...Hope this helps..Booda2us

Here is a solution from Castlecops:brightguy


Joined: Dec 19, 2004
Posts: 6
Location: USA

 Posted: Tue Jan 11, 2005 12:05 am    Post subject: [b]FINALLY... SUCCESS!!![/b]  

Okay, I finally solved the problem and thought I would share it, as I know others have had the same issue. I cannot pin-point to a 'T' the exact cause, but I will take you thru my steps:

- Windows XP Home SP2
- Panda Titanium Anti-Virus Software

- The RPC Shutdown notice kept coming up
- No ability to add/remove software as the RPC Shutdown would occur
- No Start Menu or Taskbar
- No ability to copy, cut or paste
- No ability to modify the properties of Services (including RPC)
- None of the previously mentioned fixes mention in this thread solved the issue permanently
- No scanning apps could detect a virus or worm of any kind; even when I piggy-backed the problematic HD onto a good system as a slave and ran several through utilities

1. I uninstalled Service Pack 2 (it let me remove it through add/remove programs without an RPC Shutdown notice)

2. I went into the Registry and removed any extraneous commands from the "Run" folders (AOL, MSN Messenger, MS Works, Quicktime, Real Media, Webshots, etc...)

3. Restarted the system

4. I went into the Registry (HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs) and manually modified the Value Data from "FailureActions" based on the values from another system running the same OS (NOTE: I verified first on the remote system that I set the values as I wanted them in the Services console... I set the actions for RPC to "Restart the service" on 1st, 2nd and Subsequent failures and also set restart to 0 minutes - then I checked the data values that were assigned in the Registry - i only changed/added the 2 digit values, leaving the extra characters at the end of each line untouched)

5. I went into "Add/Remove Programs" and removed several apps (AOL and all of the components, Webshots, Panda Anti-Virus). I was able to remove all of them successfully without a shutdown notice. I also did them in one fell swoop, dismissing any restart requests until I was finished.

6. I restarted the system and found my Start menu had returned, my taskbar was back and everything seemed to be working perfectly.

7. I reinstalled SP2 and then I installed Norton Anti-Virus 2005

The system is trouble-free as of now. From my analysis, I think that there were some issues with the AOL 9.0 software. I doubt I ever needed to unistall SP2, but I did it anyway.

I hope this is of help to someone out there... as I am not a big computer guru, I really can't make heads-or-tails of the official diagnosis, but I'm guessing that there were some software conflicts.

Thanks to everyone  
Hope this is of some help....Booda2us



Thanks for your quick response.
I had tried to perform repair with original OS disc without success before my posting.
It told me that I had no hard drives to perform repair. Eventhough the computer tries to boot up from the hard drive. Go figure.
The solution you posted from castlecops will not work since I am unable to logon prior to the automatic shutdown. Perhaps when I get into Windows...

Thank you,

Some viruses also do that scan the drive for viruses and whilst you are logged in go start->run>shutdown -a this will stop shutdown temporarily and give you more time to troubleshoot
Top Expert 2006

What you need to do is get your hands on a windows 2000 resource kit and install shutdown.exe then goto the command prompt and issue the command shutdown.exe -a to abort the shutdown the change the rpc to not rebbot on error and apply patchs should fix the issue.


I do not understand you mean when you say: "Some viruses also do that scan the drive for viruses..."
Could you please elaborate?

Is it possible to download the executable you mentioned in your response (shutdown.exe)?

Thank you both,


I was able to download shutdown.exe (from the Resource Kit), how do I use it?
What I mean is, can you explain to me how would you use/run it to prevent the automatic shutdown?


Please keep in mind that I can not boot up and logon with this system.
Installation from within the installed OS is not possible. The automatic shutdown does not allow me time to get into the operating system.
Therefore, the installations or issued command must take place by an alternative way of booting up the computer.

Thank you,

Click Start > Run. The Run dialog box appears.


in the open line, and then click OK. The Services window opens.

In the right pane, locate the Remote Procedure Call (RPC) service.

CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

Right-click the Remote Procedure Call (RPC) service, and then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.

CAUTION: Make sure that you change these settings back once you have removed the worm.

Now clean your computer


GooD LucK
Top Expert 2006
This one is on us!
(Get your first solution completely free - no credit card required)


Ok, this is a summary of the events.
I got into the recovery console and disable the RPC service. Also, I renamed the services.exe file and copied another services.exe from another server installation.
The computer boots up but I does not have the TCP/IP properties available for me to configure. I can not get internet connection.
Is the RPC to blame?
Any ideas?

Top Expert 2006

Yes sna if you dont have RPC you dont have the internet.


Thank you everyone who helped me resolve this issue.
I applied the security patch to repair the hole in the RPC service.
Then I used the recovery console to enable the RPC service I had disabled.
After that the system booted up without a problem.
Downloaded and installed service pack 4 and 37 other security patches from Microsoft.
Upgraded antivirus.
The works.
The server is back to work.

Cheers !!


Snafix was it a patch that fixed the lsass.exe security hole which could have been used by a virus like the Sasser virus?. Let me know what if you found inything like that I am curious.





I believe that the patch repaired the security, or the lack thereof, of the lsass.exe.
Once I stopped the RPC service, and I was able to run the patch within Windows, I could see the light at the end of the "hole".
After that, I enabled the RPC service and I found myself in the clear.
As I've mentioned in my previous response, this server had not been administered for a while--I downloaded and installed 37 security patches!
We are lucky we got this box out of the ICU, and it is back without a reinstall. Pretty lucky fellow.

Thank you for your interest,


Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.