How to Disable SAP Broadcast for RPC Service

ID: Q171307

The information in this article applies to:

Microsoft Windows NT Workstation version 4.0
Microsoft Windows NT Server version 4.0
Microsoft Windows NT Server version 4.0, Terminal Server Edition

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SYMPTOMS

On a computer running Windows NT Server, if Gateway Services for NetWare (GSNW) is installed, a SAP Type 640 broadcasts every 60 seconds by the remote procedure call (RPC) service. This SAP broadcast continues even if the user disables the GSNW and the SAP Agent Service.

On a computer running Windows NT Workstation, the RPC service does the SAP broadcast if the Client Services for NetWare (CSNW) and the SAP Agent service are installed. This SAP broadcast continues even if the user disables the SAP agent.

CAUSE

By default, the RPC service checks for the presence of Gateway Services for NetWare and the SAP Agent service on the computer running Windows NT Server.

On the computer running Windows NT Workstation with CSNW, the RPC service checks for the SAP Agent service. If the services are present, RPC starts its own thread that does the SAP broadcast Type 640 every minute.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT Server 4.0, Terminal Server Edition. For additional information, please see the following article in the Microsoft Knowledge Base:

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:

http://www.microsoft.com/windows/servicepacks/

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://www.microsoft.com/support/supportnet/overview/overview.asp

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If You Are Eligible for No-Charge Technical Support

MORE INFORMATION

After applying this fix, perform the steps below to create a new registry value.

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

Run Registry Editor (Regedt32.exe).

Go to the following key in the registry:


      HKEY_LOCAL_MACHINE\Software\Microsoft\RPC

On the Edit menu, click Add Value and use the following entry:
```
      Value Name: AdvertiseRpcService
      Data Type:  REG_SZ
      String:     No 
```
Using No for the string turns RPC sapping off.
Using Yes for the string turns RPC sapping on.

Restart the computer for the registry change to take effect.

If the SAP broadcasts continue after following these steps, you may want to disable SAP broadcasts as a troubleshooting step. To disable SAP broadcasts, delete the Ncacn_spx string value in following registry key:


   HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\ServerProtocols\

NOTE: This should be used only as a troubleshooting step. Deleting this string value completely disables SAP broadcasts which some programs may need in order to function properly.

For additional information about, please see the following article in the Microsoft Knowledge Base:

Q142533 0x640 SAP Packets Increase Using Remote Registry Service

STATUS

Microsoft has confirmed this to be a problem in Windows NT Server 4.0, Terminal Server Edition. This problem was first corrected in Windows NT Server 4.0, Terminal Server Edition Service Pack 3. This problem was first corrected in Windows NT 4.0 Service Pack 5.

Additional query words:

Keywords : kbother NT4SP4Fix kbbug4.00 kbfix4.00 nt4sp5fix NTSrvWkst
Version : winnt:4.0
Platform : winnt
Issue type : kbbug