| Windows Interfaces and RPC Services | Credit: http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en | ||
| Named pipe | Description | Win32 service or process | Interface identifier |
| atsvc | Scheduler service | mstask.exe | 1ff70682-0a51-30e8-076d-740be8cee98b |
| AudioSrv | Windows Audio service | AudioSrv | 3faf4738-3a21-4307-b46c-fdda9bb8c0d5 |
| browser (ntsvcs alias) | Computer Browser | Browser | 6bffd098-a112-3610-9833-012892020162 |
| cert | Certificate service | certsrv.exe | 91ae6020-9e3c-11cf-8d7c-00aa00c091be |
| Ctx_WinStation_API_service | Terminal Services remote management | termsrv.exe | 5ca4a760-ebb1-11cf-8611-00a0245420ed |
| DAV RPC SERVICE | WebDAV client | WebClient | c8cb7687-e6d3-11d2-a958-00c04f682e16 |
| dnsserver | DNS Server | dns.exe | 50abc2a4-574d-40b3-9d66-ee4fd5fba076 |
| epmapper | RPC endpoint mapper | RpcSs | e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0 |
| eventlog (ntsvcs alias) | Eventlog service | Eventlog | 82273fdc-e32a-18c3-3f78-827929dc23ea |
| HydraLsPipe | Terminal Server Licensing | lserver.exe | 3d267954-eeb7-11d1-b94e-00c04fa3080d |
| InitShutdown | (Remote) system shutdown | winlogon.exe | 894de0c0-0d55-11d3-a322-00c04fa321a1 |
| keysvc | Cryptographic services | CryptSvc | 8d0ffe72-d252-11d0-bf8f-00c04fd9126b |
| keysvc | Cryptographic services | CryptSvc | 0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 |
| locator | RPC Locator service | locator.exe | d6d70ef0-0e3b-11cb-acc3-08002b1d29c4 |
| llsrpc | License Logging service | llssrv.exe | 342cfd40-3c6c-11ce-a893-08002b2e9c6d |
| lsarpc (lsass alias) | LSA access | lsass.exe | 12345778-1234-abcd-ef00-0123456789ab |
| lsarpc (lsass alias) | LSA DS access | lsass.exe | 3919286a-b10c-11d0-9ba8-00c04fd92ef5 |
| msgsvc (ntsvcs alias) | Messenger service | messenger | 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc |
| netdfs | Distributed File System service | Dfssvc | 4fc742e0-4a10-11cf-8273-00aa004ae673 v3.0 |
| netlogon (lsass alias) | Net Logon service | Netlogon | 12345678-1234-abcd-ef00-01234567cffb |
| ntsvcs | Plug and Play service | services.exe | 8d9f4e40-a03d-11ce-8f69-08003e30051b |
| policyagent | IPSEC Policy Agent (Windows 2000) | PolicyAgent | d335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5 |
| ipsec | IPsec Services | PolicyAgent | 12345678-1234-abcd-ef00-0123456789ab |
| ProfMapApi | Userenv | winlogon.exe | 369ce4f0-0fdc-11d3-bde8-00c04f8eee78 |
| protected_storage | Protected Storage | lsass.exe | c9378ff1-16f7-11d0-a0b2-00aa0061426a |
| ROUTER | Remote Access | mprdim.dll | 8f09f000-b7ed-11ce-bbd2-00001a181cad |
| samr (lsass alias) | SAM access | lsass.exe | 12345778-1234-abcd-ef00-0123456789ac |
| scerpc | Security Configuration Editor (SCE) | services.exe | 93149ca2-973b-11d1-8c39-00c04fb984f9 |
| SECLOGON | Secondary logon service | seclogon | 12b81e99-f207-4a4c-85d3-77b42f76fd14 |
| SfcApi | Windows File Protection | winlogon.exe | 83da7c00-e84f-11d2-9807-00c04f8ec850 |
| spoolss | Spooler service | spoolsv.exe | 12345678-1234-abcd-ef00-0123456789ab |
| srvsvc (ntsvcs alias) | Server service | lsass.exe | 4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0 |
| ssdpsrv | SSDP service | ssdpsrv | 4b112204-0e19-11d3-b42b-0000f81feb9f |
| svcctl (ntsvcs alias) | Services control manager | services.exe | 367aeb81-9844-35f1-ad32-98f038001003 |
| tapsrv | Telephony service | Tapisrv | 2f5f6520-ca46-1067-b319-00dd010662da |
| trkwks | Distributed Link Tracking Client | Trkwks | 300f3532-38cc-11d0-a3f0-0020af6b0add v1.2 |
| W32TIME (ntsvcs alias) | Windows Time (Windows 2000 and XP) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 |
| W32TIME_ALT | Windows Time (Windows Server 2003) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 |
| winlogonrpc | Winlogon | winlogon.exe | a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 |
| winreg | Remote registry service | RemoteRegistry | 338cd001-2244-31f1-aaaa-900038001003 |
| winspipe | WINS service | wins.exe | 45f52c28-7f9f-101a-b52b-08002b2efabe |
| wkssvc (ntsvcs alias) | Workstation service | lsass.exe | 6bffd098-a112-3610-9833-46c3f87e345a |
| winreg interface | |||
| Interface | Operation number | Operation name | |
| 338cd001-2244-31f1-aaaa-900038001003 | |||
| 0x00 | OpenClassesRoot | ||
| 0x01 | OpenCurrentUser | ||
| 0x02 | OpenLocalMachine | ||
| 0x03 | OpenPerformanceData | ||
| 0x04 | OpenUsers | ||
| 0x05 | BaseRegCloseKey | ||
| 0x06 | BaseRegCreateKey | ||
| 0x07 | BaseRegDeleteKey | ||
| 0x08 | BaseRegDeleteValue | ||
| 0x09 | BaseRegEnumKey | ||
| 0x0a | BaseRegEnumValue | ||
| 0x0b | BaseRegFlushKey | ||
| 0x0c | BaseRegGetKeySecurity | ||
| 0x0d | BaseRegLoadKey | ||
| 0x0e | BaseRegNotifyChangeKeyValue | ||
| 0x0f | BaseRegOpenKey | ||
| 0x10 | BaseRegQueryInfoKey | ||
| 0x11 | BaseRegQueryValue | ||
| 0x12 | BaseRegReplaceKey | ||
| 0x13 | BaseRegRestoreKey | ||
| 0x14 | BaseRegSaveKey | ||
| 0x15 | BaseRegSetKeySecurity | ||
| * Note: Windows 2000 | 0x16 | BaseRegSetValue | |
| - | 0x17 | BaseRegUnLoadKey | |
| - | 0x18 | BaseInitiateSystemShutdown | |
| - | 0x19 | BaseAbortSystemShutdown | |
| - | 0x1a | BaseRegGetVersion | |
| - | 0x1b | OpenCurrentConfig | |
| - | 0x1c | OpenDynData | |
| - | 0x1d | BaseRegQueryMultipleValues | |
| - | 0x1e | BaseInitiateSystemShutdownEx | |
| * Note: Windows XP and Windows Server 2003 | 0x1f | BaseRegSaveKeyEx | |
| - | 0x20 | OpenPerformanceText | |
| - | 0x21 | OpenPerformanceNlsText | |
| - | 0x22 | BaseRegQueryMultipleValues2 | |
| lsarpc interface | |||
| Interface | Operation number | Operation name | |
| 12345778-1234-abcd-ef00-0123456789ab | |||
| 0x00 | LsarClose | ||
| 0x01 | LsarDelete | ||
| 0x02 | LsarEnumeratePrivileges | ||
| 0x03 | LsarQuerySecurityObject | ||
| 0x04 | LsarSetSecurityObject | ||
| 0x05 | LsarChangePassword | ||
| 0x06 | LsarOpenPolicy | ||
| 0x07 | LsarQueryInformationPolicy | ||
| 0x08 | LsarSetInformationPolicy | ||
| 0x09 | LsarClearAuditLog | ||
| 0x0a | LsarCreateAccount | ||
| 0x0b | LsarEnumerateAccounts | ||
| 0x0c | LsarCreateTrustedDomain | ||
| 0x0d | LsarEnumerateTrustedDomains | ||
| 0x0e | LsarLookupNames | ||
| 0x0f | LsarLookupSids | ||
| 0x10 | LsarCreateSecret | ||
| 0x11 | LsarOpenAccount | ||
| 0x12 | LsarEnumeratePrivilegesAccount | ||
| 0x13 | LsarAddPrivilegesToAccount | ||
| 0x14 | LsarRemovePrivilegesFromAccount | ||
| 0x15 | LsarGetQuotasForAccount | ||
| 0x16 | LsarSetQuotasForAccount | ||
| 0x17 | LsarGetSystemAccessAccount | ||
| 0x18 | LsarSetSystemAccessAccount | ||
| 0x19 | LsarOpenTrustedDomain | ||
| 0x1a | LsarQueryInfoTrustedDomain | ||
| 0x1b | LsarSetInformationTrustedDomain | ||
| 0x1c | LsarOpenSecret | ||
| 0x1d | LsarSetSecret | ||
| 0x1e | LsarQuerySecret | ||
| 0x1f | LsarLookupPrivilegeValue | ||
| 0x20 | LsarLookupPrivilegeName | ||
| 0x21 | LsarLookupPrivilegeDisplayName | ||
| 0x22 | LsarDeleteObject | ||
| 0x23 | LsarEnumerateAccountsWithUserRight | ||
| 0x24 | LsarEnumerateAccountRights | ||
| 0x25 | LsarAddAccountRights | ||
| 0x26 | LsarRemoveAccountRights | ||
| 0x27 | LsarQueryTrustedDomainInfo | ||
| 0x28 | LsarSetTrustedDomainInfo | ||
| * Note: Windows 2000 | 0x29 | LsarDeleteTrustedDomain | |
| - | 0x2a | LsarStorePrivateData | |
| - | 0x2b | LsarRetrievePrivateData | |
| - | 0x2c | LsarOpenPolicy2 | |
| - | 0x2d | LsarGetUserName | |
| - | 0x2e | LsarQueryInformationPolicy2 | |
| - | 0x2f | LsarSetInformationPolicy2 | |
| - | 0x30 | LsarQueryTrustedDomainInfoByName | |
| - | 0x31 | LsarSetTrustedDomainInfoByName | |
| - | 0x32 | LsarEnumerateTrustedDomainsEx | |
| - | 0x33 | LsarCreateTrustedDomainEx | |
| - | 0x34 | LsarCloseTrustedDomainEx | |
| - | 0x35 | LsarQueryDomainInformationPolicy | |
| - | 0x36 | LsarSetDomainInformationPolicy | |
| - | 0x37 | LsarOpenTrustedDomainByName | |
| - | 0x38 | LsarTestCall | |
| - | 0x39 | LsarLookupSids2 | |
| - | 0x3a | LsarLookupNames2 | |
| - | 0x3b | LsarCreateTrustedDomainEx2 | |
| * Note: Windows XP and Windows Server 2003 | 0x3c | CredrWrite | |
| - | 0x3d | CredrRead | |
| - | 0x3e | CredrEnumerate | |
| - | 0x3f | CredrWriteDomainCredentials | |
| - | 0x40 | CredrReadDomainCredentials | |
| - | 0x41 | CredrDelete | |
| - | 0x42 | CredrGetTargetInfo | |
| - | 0x43 | CredrProfileLoaded | |
| - | 0x44 | LsarLookupNames3 | |
| - | 0x45 | CredrGetSessionTypes | |
| - | 0x46 | LsarRegisterAuditEvent | |
| - | 0x47 | LsarGenAuditEvent | |
| - | 0x48 | LsarUnregisterAuditEvent | |
| - | 0x49 | LsarQueryForestTrustInformation | |
| - | 0x4a | LsarSetForestTrustInformation | |
| - | 0x4b | CredrRename | |
| - | 0x4c | LsarLookupSids3 | |
| - | 0x4d | LsarLookupNames4 | |
| - | 0x4e | LsarOpenPolicySce | |
| - | 0x4f | LsarAdtRegisterSecurityEventSource | |
| - | 0x50 | LsarAdtUnregisterSecurityEventSource | |
| - | 0x51 | LsarAdtReportSecurityEvent | |
| samr interface | |||
| Interface | Operation number | Operation name | |
| 12345778-1234-abcd-ef00-0123456789ac | |||
| 0x00 | SamrConnect | ||
| 0x01 | SamrCloseHandle | ||
| 0x02 | SamrSetSecurityObject | ||
| 0x03 | SamrQuerySecurityObject | ||
| 0x04 | SamrShutdownSamServer | ||
| 0x05 | SamrLookupDomainInSamServer | ||
| 0x06 | SamrEnumerateDomainsInSamServer | ||
| 0x07 | SamrOpenDomain | ||
| 0x08 | SamrQueryInformationDomain | ||
| 0x09 | SamrSetInformationDomain | ||
| 0x0a | SamrCreateGroupInDomain | ||
| 0x0b | SamrEnumerateGroupsInDomain | ||
| 0x0c | SamrCreateUserInDomain | ||
| 0x0d | SamrEnumerateUsersInDomain | ||
| 0x0e | SamrCreateAliasInDomain | ||
| 0x0f | SamrEnumerateAliasesInDomain | ||
| 0x10 | SamrGetAliasMembership | ||
| 0x11 | SamrLookupNamesInDomain | ||
| 0x12 | SamrLookupIdsInDomain | ||
| 0x13 | SamrOpenGroup | ||
| 0x14 | SamrQueryInformationGroup | ||
| 0x15 | SamrSetInformationGroup | ||
| 0x16 | SamrAddMemberToGroup | ||
| 0x17 | SamrDeleteGroup | ||
| 0x18 | SamrRemoveMemberFromGroup | ||
| 0x19 | SamrGetMembersInGroup | ||
| 0x1a | SamrSetMemberAttributesOfGroup | ||
| 0x1b | SamrOpenAlias | ||
| 0x1c | SamrQueryInformationAlias | ||
| 0x1d | SamrSetInformationAlias | ||
| 0x1e | SamrDeleteAlias | ||
| 0x1f | SamrAddMemberToAlias | ||
| 0x20 | SamrRemoveMemberFromAlias | ||
| 0x21 | SamrGetMembersInAlias | ||
| 0x22 | SamrOpenUser | ||
| 0x23 | SamrDeleteUser | ||
| 0x24 | SamrQueryInformationUser | ||
| 0x25 | SamrSetInformationUser | ||
| 0x26 | SamrChangePasswordUser | ||
| 0x27 | SamrGetGroupsForUser | ||
| 0x28 | SamrQueryDisplayInformation | ||
| 0x29 | SamrGetDisplayEnumerationIndex | ||
| 0x2a | SamrTestPrivateFunctionsDomain | ||
| 0x2b | SamrTestPrivateFunctionsUser | ||
| 0x2c | SamrGetUserDomainPasswordInformation | ||
| * Note: Windows 2000 | 0x2d | SamrRemoveMemberFromForeignDomain | |
| - | 0x2e | SamrQueryInformationDomain2 | |
| - | 0x2f | SamrQueryInformationUser2 | |
| - | 0x30 | SamrQueryDisplayInformation2 | |
| - | 0x31 | SamrGetDisplayEnumerationIndex2 | |
| - | 0x32 | SamrCreateUser2InDomain | |
| - | 0x33 | SamrQueryDisplayInformation3 | |
| - | 0x34 | SamrAddMultipleMembersToAlias | |
| - | 0x35 | SamrRemoveMultipleMembersFromAlias | |
| - | 0x36 | SamrOemChangePasswordUser2 | |
| - | 0x37 | SamrUnicodeChangePasswordUser2 | |
| - | 0x38 | SamrGetDomainPasswordInformation | |
| - | 0x39 | SamrConnect2 | |
| - | 0x3a | SamrSetInformationUser2 | |
| - | 0x3b | SamrSetBootKeyInformation | |
| - | 0x3c | SamrGetBootKeyInformation | |
| - | 0x3d | SamrConnect3 | |
| - | 0x3e | SamrConnect4 | |
| - | 0x3f | SamrUnicodeChangePasswordUser3 | |
| * Note: Windows XP and Windows Server 2003 | 0x40 | SamrConnect5 | |
| - | 0x41 | SamrRidToSid | |
| - | 0x42 | SamrSetDSRMPassword | |
| - | 0x43 | SamrValidatePassword | |
| netlogon interface | |||
| Interface | Operation number | Operation name | |
| 12345678-1234-abcd-ef00-01234567cffb | |||
| 0x00 | NetrLogonUasLogon | ||
| 0x01 | NetrLogonUasLogoff | ||
| 0x02 | NetrLogonSamLogon | ||
| 0x03 | NetrLogonSamLogoff | ||
| 0x04 | NetrServerReqChallenge | ||
| 0x05 | NetrServerAuthenticate | ||
| 0x06 | NetrServerPasswordSet | ||
| 0x07 | NetrDatabaseDeltas | ||
| 0x08 | NetrDatabaseSync | ||
| 0x09 | NetrAccountDeltas | ||
| 0x0a | NetrAccountSync | ||
| 0x0b | NetrGetDCName | ||
| 0x0c | NetrLogonControl | ||
| 0x0d | NetrGetAnyDCName | ||
| 0x0e | NetrLogonControl2 | ||
| 0x0f | NetrServerAuthenticate2 | ||
| 0x10 | NetrDatabaseSync2 | ||
| 0x11 | NetrDatabaseRedo | ||
| 0x12 | NetrLogonControl2Ex | ||
| 0x13 | NetrEnumerateTrustedDomains | ||
| * Note: Windows 2000 | 0x14 | DsrGetDcName | |
| - | 0x15 | NetrLogonDummyRoutine1 | |
| - | 0x16 | NetrLogonSetServiceBits | |
| - | 0x17 | NetrLogonGetTrustRid | |
| - | 0x18 | NetrLogonComputeServerDigest | |
| - | 0x19 | NetrLogonComputeClientDigest | |
| - | 0x1a | NetrServerAuthenticate3 | |
| - | 0x1b | DsrGetDcNameEx | |
| - | 0x1c | DsrGetSiteName | |
| - | 0x1d | NetrLogonGetDomainInfo | |
| - | 0x1e | NetrServerPasswordSet2 | |
| - | 0x1f | NetrServerPasswordGet | |
| - | 0x20 | NetrLogonSendToSam | |
| - | 0x21 | DsrAddressToSiteNamesW | |
| - | 0x22 | DsrGetDcNameEx2 | |
| - | 0x23 | NetrLogonGetTimeServiceParentDomain | |
| - | 0x24 | NetrEnumerateTrustedDomainsEx | |
| - | 0x25 | DsrAddressToSiteNamesExW | |
| - | 0x26 | DsrGetDcSiteCoverageW | |
| - | 0x27 | NetrLogonSamLogonEx | |
| - | 0x28 | DsrEnumerateDomainTrusts | |
| - | 0x29 | DsrDeregisterDnsHostRecords | |
| - | 0x2a | NetrServerTrustPasswordsGet | |
| * Note: Windows XP and Windows Server 2003 | 0x2b | DsrGetForestTrustInformation | |
| - | 0x2c | NetrGetForestTrustInformation | |
| - | 0x2d | NetrLogonSamLogonWithFlags | |
| - | 0x2e | NetrServerGetTrustInfo | |
| browser interface | |||
| Interface | Operation number | Operation name | |
| 6bffd098-a112-3610-9833-012892020162 | |||
| 0x00 | BrowserrServerEnum | ||
| 0x01 | BrowserrDebugCall | ||
| 0x02 | BrowserrQueryOtherDomains | ||
| 0x03 | BrowserrResetNetlogonState | ||
| 0x04 | BrowserrDebugTrace | ||
| 0x05 | BrowserrQueryStatistics | ||
| 0x06 | BrowserrResetStatistics | ||
| 0x07 | NetrBrowserStatisticsClear | ||
| 0x08 | NetrBrowserStatisticsGet | ||
| 0x09 | BrowserrSetNetlogonState | ||
| 0x0a | BrowserrQueryEmulatedDomains | ||
| 0x0b | BrowserrServerEnumEx | ||
| netdfs interface | |||
| Interface | Operation number | Operation name | |
| 4fc742e0-4a10-11cf-8273-00aa004ae673 | |||
| 0x00 | NetrDfsManagerGetVersion | ||
| 0x01 | NetrDfsAdd | ||
| 0x02 | NetrDfsRemove | ||
| 0x03 | NetrDfsSetInfo | ||
| 0x04 | NetrDfsGetInfo | ||
| 0x05 | NetrDfsEnum | ||
| 0x06 | NetrDfsRename | ||
| 0x07 | NetrDfsMove | ||
| 0x08 | NetrDfsManagerGetConfigInfo | ||
| 0x09 | NetrDfsManagerSendSiteInfo | ||
| 0x0a | NetrDfsAddFtRoot | ||
| 0x0b | NetrDfsRemoveFtRoot | ||
| 0x0c | NetrDfsAddStdRoot | ||
| 0x0d | NetrDfsRemoveStdRoot | ||
| 0x0e | NetrDfsManagerInitialize | ||
| 0x0f | NetrDfsAddStdRootForced | ||
| 0x10 | NetrDfsGetDcAddress | ||
| 0x11 | NetrDfsSetDcAddress | ||
| 0x12 | NetrDfsFlushFtTable | ||
| 0x13 | NetrDfsAdd2 | ||
| 0x14 | NetrDfsRemove2 | ||
| 0x15 | NetrDfsEnumEx | ||
| 0x16 | NetrDfsSetInfo2 | ||
| srvsvc interface | |||
| Interface | Operation number | Operation name | |
| 4b324fc8-1670-01d3-1278-5a47bf6ee188 | |||
| 0x00 | NetrCharDevEnum | ||
| 0x01 | NetrCharDevGetInfo | ||
| 0x02 | NetrCharDevControl | ||
| 0x03 | NetrCharDevQEnum | ||
| 0x04 | NetrCharDevQGetInfo | ||
| 0x05 | NetrCharDevQSetInfo | ||
| 0x06 | NetrCharDevQPurge | ||
| 0x07 | NetrCharDevQPurgeSelf | ||
| 0x08 | NetrConnectionEnum | ||
| 0x09 | NetrFileEnum | ||
| 0x0a | NetrFileGetInfo | ||
| 0x0b | NetrFileClose | ||
| 0x0c | NetrSessionEnum | ||
| 0x0d | NetrSessionDel | ||
| 0x0e | NetrShareAdd | ||
| 0x0f | NetrShareEnum | ||
| 0x10 | NetrShareGetInfo | ||
| 0x11 | NetrShareSetInfo | ||
| 0x12 | NetrShareDel | ||
| 0x13 | NetrShareDelSticky | ||
| 0x14 | NetrShareCheck | ||
| 0x15 | NetrServerGetInfo | ||
| 0x16 | NetrServerSetInfo | ||
| 0x17 | NetrServerDiskEnum | ||
| 0x18 | NetrServerStatisticsGet | ||
| 0x19 | NetrServerTransportAdd | ||
| 0x1a | NetrServerTransportEnum | ||
| 0x1b | NetrServerTransportDel | ||
| 0x1c | NetrRemoteTOD | ||
| 0x1d | NetrServerSetServiceBits | ||
| 0x1e | NetprPathType | ||
| 0x1f | NetprPathCanonicalize | ||
| 0x20 | NetprPathCompare | ||
| 0x21 | NetprNameValidate | ||
| 0x22 | NetprNameCanonicalize | ||
| 0x23 | NetprNameCompare | ||
| 0x24 | NetrShareEnumSticky | ||
| 0x25 | NetrShareDelStart | ||
| 0x26 | NetrShareDelCommit | ||
| 0x27 | NetrpGetFileSecurity | ||
| 0x28 | NetrpSetFileSecurity | ||
| 0x29 | NetrServerTransportAddEx | ||
| 0x2a | NetrServerSetServiceBitsEx | ||
| 0x2b | NetrDfsGetVersion | ||
| * Note: Windows 2000 | 0x2c | NetrDfsCreateLocalPartition | |
| - | 0x2d | NetrDfsDeleteLocalPartition | |
| - | 0x2e | NetrDfsSetLocalVolumeState | |
| - | 0x2f | NetrDfsSetServerInfo | |
| - | 0x30 | NetrDfsCreateExitPoint | |
| - | 0x31 | NetrDfsDeleteExitPoint | |
| - | 0x32 | NetrDfsModifyPrefix | |
| - | 0x33 | NetrDfsFixLocalVolume | |
| - | 0x34 | NetrDfsManagerReportSiteInfo | |
| * Note: Windows XP and Windows Server 2003 | 0x35 | NetrServerTransportDelEx | |
| EPM & RPC services running in the rpcss service | |||
| Interface | Operation number | Operation name | |
| e1af8308-5d1f-11c9-91a4-08002b14a0fa | |||
| 0x00 | ept_insert | ||
| 0x01 | ept_delete | ||
| 0x02 | ept_lookup | ||
| 0x03 | ept_map | ||
| 0x04 | ept_lookup_handle_free | ||
| 0x05 | ept_inq_object | ||
| 0x06 | ept_mgmt_delete | ||
| 0x07 | ept_map_auth | ||
| Messenger service | |||
| Interface | Operation number | Operation name | |
| 17fdd703-1827-4e34-79d4-24a55c53bb37 | |||
| 0x00 | NetrMessageNameAdd | ||
| 0x01 | NetrMessageNameEnum | ||
| 0x02 | NetrMessageNameGetInfo | ||
| 0x03 | NetrMessageNameDel | ||
| Interface | Operation number | Operation name | |
| 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc | |||
| 0x00 | NetrSendMessage | ||
| WINS service | |||
| Interface | Operation number | Operation name | |
| 45f52c28-7f9f-101a-b52b-08002b2efabe | |||
| 0x00 | R_WinsRecordAction | ||
| 0x01 | R_WinsStatus | ||
| 0x02 | R_WinsTrigger | ||
| 0x03 | R_WinsDoStaticInit | ||
| 0x04 | R_WinsDoScavenging | ||
| 0x05 | R_WinsGetDbRecs | ||
| 0x06 | R_WinsTerm | ||
| 0x07 | R_WinsBackup | ||
| 0x08 | R_WinsDelDbRecs | ||
| 0x09 | R_WinsPullRange | ||
| 0x0a | R_WinsSetPriorityClass | ||
| 0x0b | R_WinsResetCounters | ||
| 0x0c | R_WinsWorkerThdUpd | ||
| 0x0d | R_WinsGetNameAndAdd | ||
| 0x0e | R_WinsGetBrowserNames_Old | ||
| 0x0f | R_WinsDeleteWins | ||
| 0x10 | R_WinsSetFlags | ||
| 0x11 | R_WinsGetDbRecsByName | ||
| 0x12 | R_WinsStatusWHdl | ||
| 0x13 | R_WinsDoScavengingNew | ||
| IIS 5 services IISADMIN | |||
| Interface | Operation number | Operation name | |
| 82ad4280-036b-11cf-972c-00aa006887b0 | |||
| 0x00 | _R_InetInfoGetVersion | ||
| 0x01 | _R_InetInfoGetAdminInformation | ||
| 0x02 | _R_InetInfoGetSites | ||
| 0x03 | _R_InetInfoSetAdminInformation | ||
| 0x04 | _R_InetInfoGetGlobalAdminInformation | ||
| 0x05 | _R_InetInfoSetGlobalAdminInformation | ||
| 0x06 | _R_InetInfoQueryStatistics | ||
| 0x07 | _R_InetInfoClearStatistics | ||
| 0x08 | _R_InetInfoFlushMemoryCache | ||
| 0x09 | _R_InetInfoGetServerCapabilities | ||
| 0x0a | _R_W3QueryStatistics2 | ||
| 0x0b | _R_W3ClearStatistics2 | ||
| 0x0c | _R_FtpQueryStatistics2 | ||
| 0x0d | _R_FtpClearStatistics2 | ||
| 0x10 | _R_IISEnumerateUsers | ||
| 0x11 | _R_IISDisconnectUser | ||
| 0x12 | _R_InitW3CounterStructure | ||
| 0x13 | _R_CollectW3PerfData | ||
| IIS 5 services SMTP | |||
| Interface | Operation number | Operation name | |
| 8cfb5d70-31a4-11cf-a7d8-00805f48a135 | |||
| 0x00 | SmtprGetAdminInformation | ||
| 0x01 | SmtprSetAdminInformation | ||
| 0x02 | SmtprQueryStatistics | ||
| 0x03 | SmtprClearStatistics | ||
| 0x04 | SmtprGetConnectedUserList | ||
| 0x05 | SmtprDisconnectUser | ||
| 0x06 | SmtprCreateUser | ||
| 0x07 | SmtprDeleteUser | ||
| 0x08 | SmtprGetUserProps | ||
| 0x09 | SmtprSetUserProps | ||
| 0x0a | SmtprCreateDistList | ||
| 0x0b | SmtprDeleteDistList | ||
| 0x0c | SmtprCreateDistListMember | ||
| 0x0d | SmtprDeleteDistListMember | ||
| 0x0e | SmtprGetNameList | ||
| 0x0f | SmtprGetNameListFromList | ||
| 0x10 | SmtprGetVRootSize | ||
| 0x11 | SmtprBackupRoutingTable | ||
| Active Directory related RPC services | |||
| e3514235-4b06-11d1-ab04-00c04fc2dcd2 | |||
| 0x00 | DRSBind | ||
| 0x01 | DRSUnbind | ||
| 0x02 | DRSReplicaSync | ||
| 0x03 | DRSGetNCChanges | ||
| 0x04 | DRSUpdateRefs | ||
| 0x05 | DRSReplicaAdd | ||
| 0x06 | DRSReplicaDel | ||
| 0x07 | DRSReplicaModify | ||
| 0x08 | DRSVerifyNames | ||
| 0x09 | DRSGetMemberships | ||
| 0x0a | DRSInterDomainMove | ||
| 0x0b | DRSGetNT4ChangeLog | ||
| 0x0c | DRSCrackNames | ||
| 0x0d | DRSWriteSPN | ||
| 0x0e | DRSRemoveDsServer | ||
| 0x0f | DRSRemoveDsDomain | ||
| 0x10 | DRSDomainControllerInfo | ||
| 0x11 | DRSAddEntry | ||
| 0x12 | DRSExecuteKCC | ||
| 0x13 | DRSGetReplInfo | ||
| 0x14 | DRSAddSidHistory | ||
| * Note: Windows XP and Windows Server 2003 | 0x15 | DRSGetMemberships2 | |
| - | 0x16 | DRSReplicaVerifyObjects | |
| - | 0x17 | DRSGetObjectExistence | |
| - | 0x18 | DRSQuerySitesByCost | |
| dssetup RPC | |||
| Interface | Operation number | Operation name | |
| 3919286a-b10c-11d0-9ba8-00c04fd92ef5 | |||
| 0x00 | DsRolerGetPrimaryDomainInformation | ||
| 0x01 | DsRolerDnsNameToFlatName | ||
| 0x02 | DsRolerDcAsDc | ||
| 0x03 | DsRolerDcAsReplica | ||
| 0x04 | DsRolerDemoteDc | ||
| 0x05 | DsRolerGetDcOperationProgress | ||
| 0x06 | DsRolerGetDcOperationResults | ||
| 0x07 | DsRolerCancel | ||
| 0x08 | DsRolerServerSaveStateForUpgrade | ||
| 0x09 | DsRolerUpgradeDownlevelServer | ||
| 0x0a | DsRolerAbortDownlevelServerUpgrade | ||
| Active Directory backup | |||
| Interface | Operation number | Operation name | |
| ecec0d70-a603-11d0-96b1-00a0c91ece30 | |||
| 0x00 | HrRBackupPrepare | ||
| 0x01 | HrRBackupEnd | ||
| 0x02 | HrRBackupGetAttachmentInformation | ||
| 0x03 | HrRBackupOpenFile | ||
| 0x04 | HrRBackupRead | ||
| 0x05 | HrRBackupClose | ||
| 0x06 | HrRBackupGetBackupLogs | ||
| 0x07 | HrRBackupTruncateLogs | ||
| 0x08 | HrRBackupPing | ||
| Active Directory restore | |||
| Interface | Operation number | Operation name | |
| 16e0cf3a-a604-11d0-96b1-00a0c91ece30 | |||
| 0x00 | HrRIsNTDSOnline | ||
| 0x01 | HrRRestorePrepare | ||
| 0x02 | HrRRestoreRegister | ||
| 0x03 | HrRRestoreRegisterComplete | ||
| 0x04 | HrRRestoreGetDatabaseLocations | ||
| 0x05 | HrRRestoreEnd | ||
| 0x06 | HrRRestoreSetCurrentLogNumber | ||
| 0x07 | HrRRestoreCheckLogsForBackup | ||
| File Replication service | |||
| Interface | Operation number | Operation name | |
| f5cc59b4-4264-101a-8c59-08002b2f8426 | |||
| 0x00 | FrsRpcSendCommPkt | ||
| 0x01 | FrsRpcVerifyPromotionParent | ||
| 0x02 | FrsRpcStartPromotionParent | ||
| 0x03 | FrsNOP | ||
| 0x04 | FrsBackupComplete | ||
| 0x05 | FrsBackupComplete | ||
| 0x06 | FrsBackupComplete | ||
| 0x07 | FrsBackupComplete | ||
| 0x08 | FrsBackupComplete | ||
| 0x09 | FrsBackupComplete | ||
| 0x0a | FrsRpcVerifyPromotionParentEx | ||
| d049b186-814f-11d1-9a3c-00c04fc9b232 | |||
| 0x00 | VerifyPromotion | ||
| 0x01 | PromotionStatus | ||
| 0x02 | StartDemotion | ||
| 0x03 | CommitDemotion | ||
| 0x04 | Set_DsPollingIntervalW | ||
| 0x05 | Get_DsPollingIntervalW | ||
| 0x06 | VerifyPromotionW | ||
| 0x07 | InfoW | ||
| 0x08 | IsPathReplicated | ||
| 0x09 | WriterCommand | ||
| a00c021c-2be2-11d2-b678-0000f87a8f8e | (perfmon svc) | ||
| 0x00 | GetIndicesOfInstancesFromServer | ||
| 0x01 | GetCounterDataOfInstancesFromServer | ||
| Active Directory ISM IP Transport | |||
| Interface | Operation number | Operation name | |
| 130ceefb-e466-11d1-b78b-00c04fa32883 | |||
| 0x00 | ISMXXX | ||
| Windows DNS server | |||
| Interface | Operation number | Operation name | |
| 50abc2a4-574d-40b3-9d66-ee4fd5fba076 | |||
| 0x00 | DnssrvOperation | ||
| 0x01 | DnssrvQuery | ||
| 0x02 | DnssrvComplexOperation | ||
| 0x03 | DnssrvEnumRecords | ||
| 0x04 | DnssrvUpdateRecord | ||
| * Note: Windows XP and Windows Server 2003 | 0x05 | DnssrvOperation2 | |
| - | 0x06 | DnssrvQuery2 | |
| - | 0x07 | DnssrvComplexOperation2 | |
| - | 0x08 | DnssrvEnumRecords2 | |
| - | 0x09 | DnssrvUpdateRecord2 | |
| Exchange Server Store - MAPI | |||
| Interface | Operation number | Operation name | |
| a4f1db00-ca47-1067-b31f-00dd010662da | |||
| 0x00 | EcDoConnect | ||
| 0x01 | EcDoDisconnect | ||
| 0x02 | EcDoRpc | ||
| 0x03 | EcGetMoreRpc | ||
| 0x04 | EcRRegisterPushNotification | ||
| 0x05 | EcRUnregisterPushNotification | ||
| 0x06 | EcDummyRpc | ||
| 0x07 | EcRGetDCName | ||
| 0x08 | EcRNetGetDCName | ||
| 0x09 | EcDoRpcExt | ||
| 1544f5e0-613c-11d1-93df-00c04fd7bd09 | |||
| 0x00 | RfrGetNewDSA | ||
| 0x01 | RfrGetFQDNFromLegacyDN | ||
| Exchange RPC services in an Active Directory domain | |||
| Interface | Operation number | Operation name | |
| f5cc5a7c-4264-101a-8c59-08002b2f8426 | |||
| 0x00 | ds_abandon | ||
| 0x01 | ds_add_entry | ||
| 0x02 | ds_bind | ||
| 0x03 | ds_compare | ||
| 0x04 | ds_list | ||
| 0x05 | ds_modify_entry | ||
| 0x06 | ds_modify_rdn | ||
| 0x07 | ds_read | ||
| 0x08 | ds_receive_result | ||
| 0x09 | ds_remove_entry | ||
| 0x0a | ds_search | ||
| 0x0b | ds_unbind | ||
| 0x0c | ds_wait | ||
| 0x0d | dra_replica_add | ||
| 0x0e | dra_replica_delete | ||
| 0x0f | dra_replica_synchronize | ||
| 0x10 | dra_reference_update | ||
| 0x11 | dra_authorize_replica | ||
| 0x12 | dra_unauthorize_replica | ||
| 0x13 | dra_adopt | ||
| 0x14 | dra_set_status | ||
| 0x15 | dra_modify_entry | ||
| 0x16 | dra_delete_subref | ||
| f5cc5a18-4264-101a-8c59-08002b2f8426 | |||
| 0x00 | NspiBind | ||
| 0x01 | NspiUnbind | ||
| 0x02 | NspiUpdateStat | ||
| 0x03 | NspiQueryRows | ||
| 0x04 | NspiSeekEntries | ||
| 0x05 | NspiGetMatches | ||
| 0x06 | NspiResortRestriction | ||
| 0x07 | NspiDNToEph | ||
| 0x08 | NspiGetPropList | ||
| 0x09 | NspiGetProps | ||
| 0x0a | NspiCompareDNTs | ||
| 0x0b | NspiModProps | ||
| 0x0c | NspiGetHierarchyInfo | ||
| 0x0d | NspiGetTemplateInfo | ||
| 0x0e | NspiModLinkAtt | ||
| 0x0f | NspiDeleteEntries | ||
| 0x10 | NspiQueryColumns | ||
| 0x11 | NspiGetNamesFromIDs | ||
| 0x12 | NspiGetIDsFromNames | ||
| 0x13 | NspiResolveNames | ||
| 0x14 | NspiResolveNamesW | ||
| RPC Remote Management Interface | |||
| Interface | Operation number | Operation name | |
| afa8bd80-7d8a-11c9-bef4-08002b102989 | |||