When you use ncacn_np or ncalrpc as the protocol sequence, the server specifies a security descriptor for the endpoint at the time it selects the protocol sequence. The security descriptor is provided as an additional parameter (an extension to the standard OSF-DCE parameters) on all functions that start with the prefixes "RpcServerUseProtseq" and "RpcServerUseAllProtseqs." The security descriptor controls whether a client can connect to the endpoint.
Each Windows NT process and thread is associated with a security token. This token includes a default security descriptor that is used for any objects created by the process, such as the endpoint. If no security descriptor is specified when calling a function with the prefixes "RpcServerUseProtseq" and "RpcServerUseAllProtseqs," the default security descriptor from the process security token is applied to the endpoint.
To guarantee that the server application is accessible to all clients, the administrator should start the server application on a process that has a default security descriptor which can be used by all clients. In Windows NT, generally only system processes have a default security descriptor.
For more information about these functions and the functions RpcImpersonateClient and RpcRevertToSelf.