Guest W Posted September 16, 2007 Posted September 16, 2007 Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Hi Sorry for the dramatic subject... I hope it’s a fairly simple thing... Basically I changed the Logon properties for the RPC service on our PDC from the original Network Service account to use the Local System account. I did this to see if it would fix an error I was having with another service not starting citing a dependency group failed to start & the only thing in the dependency group is the RPC. So... I thought if I changed the Logon credentials and it worked I'd have a better clue as to what was wrong... (That probably sounds very irrational but it made sense at the time). I did have every intention of changing it back... but... Once I'd rebooted the server I found that the option to change the Logon type back to a Network Service account was greyed out... DOH!!! What a shmuck I am... I should have realised what a dumb thing it was to mess with the RPC anyway I know. I feel like a n00b. Maybe I am... Anyway, can someone help me change this back? I've actually not encountered any errors at all but something tells me the increased privileges that a Local System account would have are probably a bad thing. Incidentally the test did not fix the service starting error. I'm guessing that as the logged on administrator I'm not aloud to change LSA stuff? Is there a way around this? Thanks for any help, much appreciated! W
Guest Pegasus \(MVP\) Posted September 16, 2007 Posted September 16, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. "W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... > Hi > Sorry for the dramatic subject... I hope it's a fairly simple thing... > > > Basically I changed the Logon properties for the RPC service on our PDC > from > the original Network Service account to use the Local System account. > > I did this to see if it would fix an error I was having with another > service > not starting citing a dependency group failed to start & the only thing in > the > dependency group is the RPC. So... I thought if I changed the Logon > credentials and it worked I'd have a better clue as to what was wrong... > (That > probably sounds very irrational but it made sense at the time). I did have > every intention of changing it back... but... Once I'd rebooted the > server I > found that the option to change the Logon type back to a Network Service > account was greyed out... DOH!!! What a shmuck I am... I should have > realised > what a dumb thing it was to mess with the RPC anyway I know. I feel like > a > n00b. Maybe I am... > > Anyway, can someone help me change this back? > > I've actually not encountered any errors at all but something tells me the > increased privileges that a Local System account would have are probably a > bad > thing. Incidentally the test did not fix the service starting error. > > I'm guessing that as the logged on administrator I'm not aloud to change > LSA > stuff? Is there a way around this? > > Thanks for any help, much appreciated! > > W If all else fails then you could restore the old registry files from your backup medium. Make sure to save the current registry files first!
Guest Mathieu CHATEAU Posted September 16, 2007 Posted September 16, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Hello, 1/change it manually from regedit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs ObjectName put back NT AUTHORITY\NetworkService you may start in Active Directory Mode to try changing it back. For the Network Service account password, just leave it blank In case it helps, here is the default registry setting for rpcss: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] "Description"="Serves as the endpoint mapper and COM Service Control Manager. If this service is stopped or disabled, programs using COM or Remote Procedure Call (RPC) services will not function properly." "DisplayName"="Remote Procedure Call (RPC)" "ErrorControl"=dword:00000001 "Group"="COM Infrastructure" "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 "ObjectName"="NT AUTHORITY\\NetworkService" "Start"=dword:00000002 "Type"=dword:00000020 "FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ 00,02,00,00,00,60,ea,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ 00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] "0"="Root\\LEGACY_RPCSS\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 -- Cordialement, Mathieu CHATEAU http://lordoftheping.blogspot.com "W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... > Hi > Sorry for the dramatic subject... I hope it's a fairly simple thing... > > > Basically I changed the Logon properties for the RPC service on our PDC > from > the original Network Service account to use the Local System account. > > I did this to see if it would fix an error I was having with another > service > not starting citing a dependency group failed to start & the only thing in > the > dependency group is the RPC. So... I thought if I changed the Logon > credentials and it worked I'd have a better clue as to what was wrong... > (That > probably sounds very irrational but it made sense at the time). I did have > every intention of changing it back... but... Once I'd rebooted the > server I > found that the option to change the Logon type back to a Network Service > account was greyed out... DOH!!! What a shmuck I am... I should have > realised > what a dumb thing it was to mess with the RPC anyway I know. I feel like > a > n00b. Maybe I am... > > Anyway, can someone help me change this back? > > I've actually not encountered any errors at all but something tells me the > increased privileges that a Local System account would have are probably a > bad > thing. Incidentally the test did not fix the service starting error. > > I'm guessing that as the logged on administrator I'm not aloud to change > LSA > stuff? Is there a way around this? > > Thanks for any help, much appreciated! > > W
Guest W Posted September 18, 2007 Posted September 18, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Thanks for the reply! I've made the reg changes & the srvices MMC shows the correct info now. I have to wait till close of business to reboot but I've got a good feeling. Thanks very much for the help. I'll post again after I reboot & let you know if it worked. W "Mathieu CHATEAU" <gollum123@free.fr> wrote: >Hello, > >1/change it manually from regedit >HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs >ObjectName >put back NT AUTHORITY\NetworkService > >you may start in Active Directory Mode to try changing it back. >For the Network Service account password, just leave it blank > >In case it helps, here is the default registry setting for rpcss: > > > >Windows Registry Editor Version 5.00 > >[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] >"Description"="Serves as the endpoint mapper and COM Service Control >Manager. If this service is stopped or disabled, programs using COM or >Remote Procedure Call (RPC) services will not function properly." >"DisplayName"="Remote Procedure Call (RPC)" >"ErrorControl"=dword:00000001 >"Group"="COM Infrastructure" >"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ > 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ > 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ > 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 >"ObjectName"="NT AUTHORITY\\NetworkService" >"Start"=dword:00000002 >"Type"=dword:00000020 >"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ > 00,02,00,00,00,60,ea,00,00 > >[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] >"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ > 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ > 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 > >[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] >"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ > 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ > 00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ > 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ > 20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ > 00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ > 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 > >[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] >"0"="Root\\LEGACY_RPCSS\\0000" >"Count"=dword:00000001 >"NextInstance"=dword:00000001 > > > > >-- >Cordialement, >Mathieu CHATEAU >http://lordoftheping.blogspot.com > > >"W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... >> Hi >> Sorry for the dramatic subject... I hope it's a fairly simple thing... >> >> >> Basically I changed the Logon properties for the RPC service on our PDC >> from >> the original Network Service account to use the Local System account. >> >> I did this to see if it would fix an error I was having with another >> service >> not starting citing a dependency group failed to start & the only thing in >> the >> dependency group is the RPC. So... I thought if I changed the Logon >> credentials and it worked I'd have a better clue as to what was wrong... >> (That >> probably sounds very irrational but it made sense at the time). I did have >> every intention of changing it back... but... Once I'd rebooted the >> server I >> found that the option to change the Logon type back to a Network Service >> account was greyed out... DOH!!! What a shmuck I am... I should have >> realised >> what a dumb thing it was to mess with the RPC anyway I know. I feel like >> a >> n00b. Maybe I am... >> >> Anyway, can someone help me change this back? >> >> I've actually not encountered any errors at all but something tells me the >> increased privileges that a Local System account would have are probably a >> bad >> thing. Incidentally the test did not fix the service starting error. >> >> I'm guessing that as the logged on administrator I'm not aloud to change >> LSA >> stuff? Is there a way around this? >> >> Thanks for any help, much appreciated! >> >> W
Guest W Posted September 18, 2007 Posted September 18, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. All sorted. 100% fine after reboot. Thanks again for reply W <W@W.org> wrote: >Thanks for the reply! >I've made the reg changes & the srvices MMC shows the correct info now. >I have to wait till close of business to reboot but I've got a good feeling. > >Thanks very much for the help. >I'll post again after I reboot & let you know if it worked. > >W > > >"Mathieu CHATEAU" <gollum123@free.fr> wrote: >>Hello, >> >>1/change it manually from regedit >>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs >>ObjectName >>put back NT AUTHORITY\NetworkService >> >>you may start in Active Directory Mode to try changing it back. >>For the Network Service account password, just leave it blank >> >>In case it helps, here is the default registry setting for rpcss: >> >> >> >>Windows Registry Editor Version 5.00 >> >>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] >>"Description"="Serves as the endpoint mapper and COM Service Control >>Manager. If this service is stopped or disabled, programs using COM or >>Remote Procedure Call (RPC) services will not function properly." >>"DisplayName"="Remote Procedure Call (RPC)" >>"ErrorControl"=dword:00000001 >>"Group"="COM Infrastructure" >>"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >> 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ >> 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ >> 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 >>"ObjectName"="NT AUTHORITY\\NetworkService" >>"Start"=dword:00000002 >>"Type"=dword:00000020 >>"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ >> 00,02,00,00,00,60,ea,00,00 >> >>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] >>"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ >> 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ >> 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 >> >>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] >>"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ >> 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ >> 00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ >> 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ >> 20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ >> 00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ >> 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 >> >>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] >>"0"="Root\\LEGACY_RPCSS\\0000" >>"Count"=dword:00000001 >>"NextInstance"=dword:00000001 >> >> >> >> >>-- >>Cordialement, >>Mathieu CHATEAU >>http://lordoftheping.blogspot.com >> >> >>"W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... >>> Hi >>> Sorry for the dramatic subject... I hope it's a fairly simple thing... >>> >>> >>> Basically I changed the Logon properties for the RPC service on our PDC >>> from >>> the original Network Service account to use the Local System account. >>> >>> I did this to see if it would fix an error I was having with another >>> service >>> not starting citing a dependency group failed to start & the only thing in >>> the >>> dependency group is the RPC. So... I thought if I changed the Logon >>> credentials and it worked I'd have a better clue as to what was wrong... >>> (That >>> probably sounds very irrational but it made sense at the time). I did have >>> every intention of changing it back... but... Once I'd rebooted the >>> server I >>> found that the option to change the Logon type back to a Network Service >>> account was greyed out... DOH!!! What a shmuck I am... I should have >>> realised >>> what a dumb thing it was to mess with the RPC anyway I know. I feel like >>> a >>> n00b. Maybe I am... >>> >>> Anyway, can someone help me change this back? >>> >>> I've actually not encountered any errors at all but something tells me the >>> increased privileges that a Local System account would have are probably a >>> bad >>> thing. Incidentally the test did not fix the service starting error. >>> >>> I'm guessing that as the logged on administrator I'm not aloud to change >>> LSA >>> stuff? Is there a way around this? >>> >>> Thanks for any help, much appreciated! >>> >>> W
Guest Mathieu CHATEAU Posted September 18, 2007 Posted September 18, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Great :) -- Cordialement, Mathieu CHATEAU http://lordoftheping.blogspot.com "W" <W@W.org> wrote in message news:part1of1.1.c9GwHDOwXiwNPw@ue.ph... > All sorted. > 100% fine after reboot. > > Thanks again for reply > > W <W@W.org> wrote: >>Thanks for the reply! >>I've made the reg changes & the srvices MMC shows the correct info now. >>I have to wait till close of business to reboot but I've got a good >>feeling. >> >>Thanks very much for the help. >>I'll post again after I reboot & let you know if it worked. >> >>W >> >> >>"Mathieu CHATEAU" <gollum123@free.fr> wrote: >>>Hello, >>> >>>1/change it manually from regedit >>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs >>>ObjectName >>>put back NT AUTHORITY\NetworkService >>> >>>you may start in Active Directory Mode to try changing it back. >>>For the Network Service account password, just leave it blank >>> >>>In case it helps, here is the default registry setting for rpcss: >>> >>> >>> >>>Windows Registry Editor Version 5.00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] >>>"Description"="Serves as the endpoint mapper and COM Service Control >>>Manager. If this service is stopped or disabled, programs using COM or >>>Remote Procedure Call (RPC) services will not function properly." >>>"DisplayName"="Remote Procedure Call (RPC)" >>>"ErrorControl"=dword:00000001 >>>"Group"="COM Infrastructure" >>>"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>> >>> 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ >>> >>> 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ >>> 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 >>>"ObjectName"="NT AUTHORITY\\NetworkService" >>>"Start"=dword:00000002 >>>"Type"=dword:00000020 >>>"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ >>> 00,02,00,00,00,60,ea,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] >>>"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ >>> >>> 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ >>> 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] >>>"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ >>> >>> 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ >>> >>> 00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ >>> >>> 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ >>> >>> 20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ >>> >>> 00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ >>> 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] >>>"0"="Root\\LEGACY_RPCSS\\0000" >>>"Count"=dword:00000001 >>>"NextInstance"=dword:00000001 >>> >>> >>> >>> >>>-- >>>Cordialement, >>>Mathieu CHATEAU >>>http://lordoftheping.blogspot.com >>> >>> >>>"W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... >>>> Hi >>>> Sorry for the dramatic subject... I hope it's a fairly simple thing... >>>> >>>> >>>> Basically I changed the Logon properties for the RPC service on our PDC >>>> from >>>> the original Network Service account to use the Local System account. >>>> >>>> I did this to see if it would fix an error I was having with another >>>> service >>>> not starting citing a dependency group failed to start & the only thing >>>> in >>>> the >>>> dependency group is the RPC. So... I thought if I changed the Logon >>>> credentials and it worked I'd have a better clue as to what was >>>> wrong... >>>> (That >>>> probably sounds very irrational but it made sense at the time). I did >>>> have >>>> every intention of changing it back... but... Once I'd rebooted the >>>> server I >>>> found that the option to change the Logon type back to a Network >>>> Service >>>> account was greyed out... DOH!!! What a shmuck I am... I should have >>>> realised >>>> what a dumb thing it was to mess with the RPC anyway I know. I feel >>>> like >>>> a >>>> n00b. Maybe I am... >>>> >>>> Anyway, can someone help me change this back? >>>> >>>> I've actually not encountered any errors at all but something tells me >>>> the >>>> increased privileges that a Local System account would have are >>>> probably a >>>> bad >>>> thing. Incidentally the test did not fix the service starting error. >>>> >>>> I'm guessing that as the logged on administrator I'm not aloud to >>>> change >>>> LSA >>>> stuff? Is there a way around this? >>>> >>>> Thanks for any help, much appreciated! >>>> >>>> W >
Guest Mathieu CHATEAU Posted September 18, 2007 Posted September 18, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. I do not blame you, but i hope you learned something about trying unsecure/managed/known changes directly on production server. You should install Microsoft Virtual PC 2007 + trial windows in VM to test stuff before just my 2 cents, do not become angry ;) -- Cordialement, Mathieu CHATEAU http://lordoftheping.blogspot.com "W" <W@W.org> wrote in message news:part1of1.1.c9GwHDOwXiwNPw@ue.ph... > All sorted. > 100% fine after reboot. > > Thanks again for reply > > W <W@W.org> wrote: >>Thanks for the reply! >>I've made the reg changes & the srvices MMC shows the correct info now. >>I have to wait till close of business to reboot but I've got a good >>feeling. >> >>Thanks very much for the help. >>I'll post again after I reboot & let you know if it worked. >> >>W >> >> >>"Mathieu CHATEAU" <gollum123@free.fr> wrote: >>>Hello, >>> >>>1/change it manually from regedit >>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs >>>ObjectName >>>put back NT AUTHORITY\NetworkService >>> >>>you may start in Active Directory Mode to try changing it back. >>>For the Network Service account password, just leave it blank >>> >>>In case it helps, here is the default registry setting for rpcss: >>> >>> >>> >>>Windows Registry Editor Version 5.00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] >>>"Description"="Serves as the endpoint mapper and COM Service Control >>>Manager. If this service is stopped or disabled, programs using COM or >>>Remote Procedure Call (RPC) services will not function properly." >>>"DisplayName"="Remote Procedure Call (RPC)" >>>"ErrorControl"=dword:00000001 >>>"Group"="COM Infrastructure" >>>"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>> >>> 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ >>> >>> 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ >>> 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 >>>"ObjectName"="NT AUTHORITY\\NetworkService" >>>"Start"=dword:00000002 >>>"Type"=dword:00000020 >>>"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ >>> 00,02,00,00,00,60,ea,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] >>>"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ >>> >>> 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ >>> 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] >>>"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ >>> >>> 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ >>> >>> 00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ >>> >>> 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ >>> >>> 20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ >>> >>> 00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ >>> 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 >>> >>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] >>>"0"="Root\\LEGACY_RPCSS\\0000" >>>"Count"=dword:00000001 >>>"NextInstance"=dword:00000001 >>> >>> >>> >>> >>>-- >>>Cordialement, >>>Mathieu CHATEAU >>>http://lordoftheping.blogspot.com >>> >>> >>>"W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... >>>> Hi >>>> Sorry for the dramatic subject... I hope it's a fairly simple thing... >>>> >>>> >>>> Basically I changed the Logon properties for the RPC service on our PDC >>>> from >>>> the original Network Service account to use the Local System account. >>>> >>>> I did this to see if it would fix an error I was having with another >>>> service >>>> not starting citing a dependency group failed to start & the only thing >>>> in >>>> the >>>> dependency group is the RPC. So... I thought if I changed the Logon >>>> credentials and it worked I'd have a better clue as to what was >>>> wrong... >>>> (That >>>> probably sounds very irrational but it made sense at the time). I did >>>> have >>>> every intention of changing it back... but... Once I'd rebooted the >>>> server I >>>> found that the option to change the Logon type back to a Network >>>> Service >>>> account was greyed out... DOH!!! What a shmuck I am... I should have >>>> realised >>>> what a dumb thing it was to mess with the RPC anyway I know. I feel >>>> like >>>> a >>>> n00b. Maybe I am... >>>> >>>> Anyway, can someone help me change this back? >>>> >>>> I've actually not encountered any errors at all but something tells me >>>> the >>>> increased privileges that a Local System account would have are >>>> probably a >>>> bad >>>> thing. Incidentally the test did not fix the service starting error. >>>> >>>> I'm guessing that as the logged on administrator I'm not aloud to >>>> change >>>> LSA >>>> stuff? Is there a way around this? >>>> >>>> Thanks for any help, much appreciated! >>>> >>>> W >
Guest W Posted September 19, 2007 Posted September 19, 2007 Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Re: Help! I changed the Logon properties for Remote procedure Call (RPC) service & can't change back. Sure did learn something ;) or rather, reminded myself of something I had learned... Top advice re: VMing the environment, I agree 100% If only I could VM the wife & I's "discussions" as well ;) All the best & thanks again W "Mathieu CHATEAU" <gollum123@free.fr> wrote: >I do not blame you, but i hope you learned something about trying >unsecure/managed/known changes directly on production server. > >You should install Microsoft Virtual PC 2007 + trial windows in VM to test >stuff before > >just my 2 cents, do not become angry ;) > >-- >Cordialement, >Mathieu CHATEAU >http://lordoftheping.blogspot.com > > >"W" <W@W.org> wrote in message news:part1of1.1.c9GwHDOwXiwNPw@ue.ph... >> All sorted. >> 100% fine after reboot. >> >> Thanks again for reply >> >> W <W@W.org> wrote: >>>Thanks for the reply! >>>I've made the reg changes & the srvices MMC shows the correct info now. >>>I have to wait till close of business to reboot but I've got a good >>>feeling. >>> >>>Thanks very much for the help. >>>I'll post again after I reboot & let you know if it worked. >>> >>>W >>> >>> >>>"Mathieu CHATEAU" <gollum123@free.fr> wrote: >>>>Hello, >>>> >>>>1/change it manually from regedit >>>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs >>>>ObjectName >>>>put back NT AUTHORITY\NetworkService >>>> >>>>you may start in Active Directory Mode to try changing it back. >>>>For the Network Service account password, just leave it blank >>>> >>>>In case it helps, here is the default registry setting for rpcss: >>>> >>>> >>>> >>>>Windows Registry Editor Version 5.00 >>>> >>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs] >>>>"Description"="Serves as the endpoint mapper and COM Service Control >>>>Manager. If this service is stopped or disabled, programs using COM or >>>>Remote Procedure Call (RPC) services will not function properly." >>>>"DisplayName"="Remote Procedure Call (RPC)" >>>>"ErrorControl"=dword:00000001 >>>>"Group"="COM Infrastructure" >>>>"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>>> >>>> >>>>74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ >>>> >>>> >>>>00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ >>>> 6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00 >>>>"ObjectName"="NT AUTHORITY\\NetworkService" >>>>"Start"=dword:00000002 >>>>"Type"=dword:00000020 >>>>"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ >>>> 00,02,00,00,00,60,ea,00,00 >>>> >>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters] >>>>"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ >>>> >>>> >>>>00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ >>>> 72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00 >>>> >>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security] >>>>"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ >>>> >>>> >>>>00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ >>>> >>>> >>>>00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ >>>> >>>> >>>>05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ >>>> >>>> >>>>20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\ >>>> >>>> >>>>00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\ >>>> 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 >>>> >>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum] >>>>"0"="Root\\LEGACY_RPCSS\\0000" >>>>"Count"=dword:00000001 >>>>"NextInstance"=dword:00000001 >>>> >>>> >>>> >>>> >>>>-- >>>>Cordialement, >>>>Mathieu CHATEAU >>>>http://lordoftheping.blogspot.com >>>> >>>> >>>>"W" <W@W.org> wrote in message news:part1of1.1.8ok2k3rUm9okSg@ue.ph... >>>>> Hi >>>>> Sorry for the dramatic subject... I hope it's a fairly simple thing... >>>>> >>>>> >>>>> Basically I changed the Logon properties for the RPC service on our PDC >>>>> from >>>>> the original Network Service account to use the Local System account. >>>>> >>>>> I did this to see if it would fix an error I was having with another >>>>> service >>>>> not starting citing a dependency group failed to start & the only thing >>>>> in >>>>> the >>>>> dependency group is the RPC. So... I thought if I changed the Logon >>>>> credentials and it worked I'd have a better clue as to what was >>>>> wrong... >>>>> (That >>>>> probably sounds very irrational but it made sense at the time). I did >>>>> have >>>>> every intention of changing it back... but... Once I'd rebooted the >>>>> server I >>>>> found that the option to change the Logon type back to a Network >>>>> Service >>>>> account was greyed out... DOH!!! What a shmuck I am... I should have >>>>> realised >>>>> what a dumb thing it was to mess with the RPC anyway I know. I feel >>>>> like >>>>> a >>>>> n00b. Maybe I am... >>>>> >>>>> Anyway, can someone help me change this back? >>>>> >>>>> I've actually not encountered any errors at all but something tells me >>>>> the >>>>> increased privileges that a Local System account would have are >>>>> probably a >>>>> bad >>>>> thing. Incidentally the test did not fix the service starting error. >>>>> >>>>> I'm guessing that as the logged on administrator I'm not aloud to >>>>> change >>>>> LSA >>>>> stuff? Is there a way around this? >>>>> >>>>> Thanks for any help, much appreciated! >>>>> >>>>> W >>
Recommended Posts