RpcSs expected value WIN32_SHARE_PROCESS

Add a comment February 12th, 2011

If you have a domain with a mixture of Win2003 and Win2008 domain controllers, you might get some ”false-positive” errors running DCDIAG.exe.

Starting test: Services
      Invalid service type: RpcSs on DC-Win2003, current value
      WIN32_OWN_PROCESS, expected value WIN32_SHARE_PROCESS
......................... DC-Win2003 failed test Services

If you run DCDIAG from a Win2003 DC it will not report any errors, but if you run it from a Win2008 DC it will report this error.

I.e. from a Win2008 DC:

Dcdiag /e (testing all DCs in the domain)

or

Dcdiag /s:DC-Win2003 /test:services (run test only against DC-Win2003).

If you look at the service on a Win2003 DC, its Type is 0×10 (own), while on a Win2008 DC its 0×20 (shared).

HKLM\System\CCS\Services\RpcSs\Type

So when you run DCDIAG from a Win2008 DC it assumes the Type should be 0×20 on all DCs it runs a diagnostic on. The DCDIAG version on Win2008 will not check if it’s testing against a Win2003 DC.

If you try to change how this service runs on a Win2003 DC with: ”sc config rpcss type= share”, it will change the Type to 0×20 and a DCDIAG (/e) will be clean.

I had to ask the MS DS team about this, since there ain’t a KB regarding this and they made a KB regarding this issue. If you google it you will get various recomendations to change the RpcSs service to run as shared. The DS team said this is expected behavior from DCDIAG. You should NOT change the way this service run on a Win2003 DC. Leave it as it is, as it will not share its memory space of the instance of svchost with anyone (nobody is requesting to share the space). Even if you change it to shared.

Reference: http://blogs.technet.com/b/askds/archive/2011/02/11/friday-mail-sack-the-year-3000-edition.aspx

  1. February 17th, 2011 at 08:35 | #1
    Rod Lee

    A big thankyou for this – we are doing a 2k3 to 2k8sp domain upgrade at the moment and encountered this error. We have had issues, and this error becuase it is not recorded in the MS Knowledgeless Base (Why dont the MS AD guys put this stuff in) would have been given undue importance and meant the project was delayed yet again.

  2. February 17th, 2011 at 09:19 | #2
    Rune

    I’ve asked them why they havn’t made a KB about this issue, since there are plenty of mixed 2003/2008 environment out there. I guess the KB will come sooner or later.

  1. No trackbacks yet.
Comments feed


− 3 = three