{"id":12094,"date":"2026-03-20T13:25:33","date_gmt":"2026-03-20T18:25:33","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=12094"},"modified":"2026-03-27T13:27:51","modified_gmt":"2026-03-27T18:27:51","slug":"querying-the-rpc-endpoint-mapper","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=12094","title":{"rendered":"Querying the RPC Endpoint Mapper"},"content":{"rendered":"\n<p>A lot of RPC services start out on a standard port (TCP port 135) and then move over to a dynamically allocated port. Fortunately, there&#8217;s a way to <em>ask<\/em> the RPC endpoint mapper what services are available and what port(s) have been assigned to that service. It uses the portqry command:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nC:\\PortQryV2&gt;portqry -n host2043.servers.example.com -e 135 -p tcp -v\n\nNote: the -v option only displays extra data in local mode\n\nQuerying target system called:\n\n host2043.servers.example.com\n\nAttempting to resolve name to IP address...\n\n\nName resolved to 10.237.73.103\n\nquerying...\n\nTCP port 135 (epmap service): LISTENING\n\nUsing ephemeral source port\nQuerying Endpoint Mapper Database...\nServer&#039;s response:\n\nUUID: 04eeb297-cbf4-466b-8a2a-bfd6a2f10bba EFSK RPC Interface\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\efsrpc]\n\nUUID: 367abb81-9844-35f1-ad32-98f038001003\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50007]\n\nUUID: 91ae6020-9e3c-11cf-8d7c-00aa00c091be\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\cert]\n\nUUID: 91ae6020-9e3c-11cf-8d7c-00aa00c091be\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50006]\n\nUUID: 29770a8f-829b-4158-90a2-78cd488501f7\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\SessEnvPublicRpc]\n\nUUID: 29770a8f-829b-4158-90a2-78cd488501f7\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50004]\n\nUUID: 7f1343fe-50a9-4927-a778-0c5859517bac DfsDs service\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\wkssvc]\n\nUUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Windows Event Log\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\eventlog]\n\nUUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Windows Event Log\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50002]\n\nUUID: 1ff70682-0a51-30e8-076d-740be8cee98b\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\atsvc]\n\nUUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\atsvc]\n\nUUID: 33d84484-3626-47ee-8c6f-e7e98b113be1\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\atsvc]\n\nUUID: 86d35949-83c9-4044-b424-db363231fd0c\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\atsvc]\n\nUUID: 86d35949-83c9-4044-b424-db363231fd0c\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50003]\n\nUUID: 3a9ef155-691d-4449-8d05-09ad57031823\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\atsvc]\n\nUUID: 3a9ef155-691d-4449-8d05-09ad57031823\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50003]\n\nUUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name\nncacn_hvsocket:host2043.servers.example.com&#x5B;F58797F6-C9F3-4D63-9BD4-E52AC020E586]\n\nUUID: 76f226c3-ec14-4325-8a99-6a46348418af\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\InitShutdown]\n\nUUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d\nncacn_np:host2043.servers.example.com&#x5B;\\\\PIPE\\\\InitShutdown]\n\nUUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50001]\n\nUUID: 12345778-1234-abcd-ef00-0123456789ac\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: 12345778-1234-abcd-ef00-0123456789ac\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50005]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50005]\n\nUUID: b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 KeyIso\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 KeyIso\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 KeyIso\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50005]\n\nUUID: 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b Ngc Pop Key Service\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b Ngc Pop Key Service\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b Ngc Pop Key Service\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50005]\n\nUUID: 51a227ae-825b-41f2-b4a9-1ac9557a1018 Ngc Pop Key Service\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\lsass]\n\nUUID: 51a227ae-825b-41f2-b4a9-1ac9557a1018 Ngc Pop Key Service\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50000]\n\nUUID: 51a227ae-825b-41f2-b4a9-1ac9557a1018 Ngc Pop Key Service\nncacn_ip_tcp:host2043.servers.example.com&#x5B;50005]\n\nUUID: df1941c5-fe89-4e79-bf10-463657acf44d EFS RPC Interface\nncacn_np:host2043.servers.example.com&#x5B;\\\\pipe\\\\efsrpc]\n\nTotal endpoints found: 38\n\n\n\n==== End of RPC Endpoint Mapper query response ====\n\n\n\n\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"<p>A lot of RPC services start out on a standard port (TCP port 135) and then move over to a dynamically allocated port. Fortunately, there&#8217;s a way to ask the RPC endpoint mapper what services are available and what port(s) have been assigned to that service. It uses the portqry command:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1525],"tags":[2172,2180,2181],"class_list":["post-12094","post","type-post","status-publish","format-standard","hentry","category-windows","tag-rpc","tag-rpc-endpoint","tag-rpc-endpoint-mapper"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12094"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12094\/revisions"}],"predecessor-version":[{"id":12095,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12094\/revisions\/12095"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}