Changing the log on for the RPC service.

[Guest]

We recently started having some issues with a 3rd party program (Scriptlogic,
handles login process), and during the course of troubleshooting it, I
determined that as a quick fix for it, if we set the RPC service to use the
Local System account as it's log on, it would work. Now I believe I've
determined the root cause of the issue (computer account corruption in the
AD), however I've been unable to figure out how to set the RPC service BACK
to logging on as Network Service account. As such, I can't really test
anything, as all the PCs that were having the issue have had the temporary
fix applied. Anyone know how I can change the affected PCs back to using the
Network Service account?

 

[Wesley Vogel]

RpcSs is Remote Procedure Call (RPC).

How did you manage to change it? You cannot change it in services.msc.

C:\WINDOWS\system32\svchost -k rpcss
rpcss = "RpcSs" (System User, Critical Service) the Remote Procedure Call
(RPC) service.

It is listed in the registry...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\SvcHost
Value Name: rpcss
Value Data: RpcSs

Value Name: ObjectName
Value Data: LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
Value Name: ImagePath
Value Data: %SystemRoot%\system32\svchost -k rpcss

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

I simply went into the Log On tab of the service property and switched it
from the This Account tick mark to the Local System account tick mark. After
you mentioned that I shouldn't be able to do it, I checked on my machine at
home, and it's also set to use the NT Authority\NetworkService account, and
allows me to switch to Local System account, but not back. I'll try the
registry entries you mentioned (specifically the ObjectName key) and let you
know how it works out.

Thanks a ton!

 

[Wesley Vogel]

Hi Greg,

My Remote Procedure Call (RPC) Properties, Log On tab page is all grayed out
except for the hardware profile Disable button. That's why I questioned how
you were able to change anything. But, the grayed out tick is in the Local
System account hole. I have XP Pro SP1 not SP2.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

That appears to be the difference. SP2 changes the RPC service to use the
NetworkService login as one of it's security fixes. The only way to change it
from LocalSytem -> NetworkService is by manually changing the
HKLM\System\CCS\Services\RpcSs:ObjectValue key you mentioned below (From
LocalSystem to "NT Authority\NetworkService").

Thanks for the help!

 

[Wesley Vogel]

Keep having fun, Greg.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Jami]

Greg,

were you able to make these changes. Mine is set to Local System also, & I
can't get it back to NT, along with password.