Quick tip: Limiting RPC dynamic port range

One annoying thing with RPC is, that it is configured to use over 16’000 ports by default (in 2008 Server). That’s absolutely not needed in most cases. I normally limit the range to 1000 ports which is more than enough, and makes firewall administrators a bit more happy… a bit…

To change the port range to f.ex. 43000-43999 you have to enter these four commands:

netsh int ipv4 set dynamicport tcp start=43000 num=1000
netsh int ipv4 set dynamicport udp start=43000 num=1000
netsh int ipv6 set dynamicport tcp start=43000 num=1000
netsh int ipv6 set dynamicport udp start=43000 num=1000

Now, reboot your server

To show the current settings:

netsh int ipv4 show dynamicport tcp
netsh int ipv4 show dynamicport udp
netsh int ipv6 show dynamicport tcp
netsh int ipv6 show dynamicport udp

If you still have to use 2003 Server, you have to create some registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet\ (Key)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet\Ports ==> 43000-43999 (REG_MULTI_SZ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet\PortsInternetAvailable ==> Y (REG_SZ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet\UseInternetPorts ==> Y (REG_SZ)

And reboot the server

This entry was posted in Firewalls, Security, Windows Server and tagged , , , , , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *