Error Message "RPC Server Is Unavailable" or "RPC Too Busy"

ID: Q242361

The information in this article applies to:

Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SYMPTOMS

You may receive the following error message:

RPC Server Is Unavailable

When this occurs, connectivity to the server stops. Rebooting the server clears the message and restores connectivity temporarily.

CAUSE

This behavior can occur if you have run the C2 Configuration Manager utility from the Microsoft Windows NT 4.0 Resource Kit. The C2 Configuration Manager utility makes changes to the server that disable network functionality if an auditable event cannot be logged.

The C2 Configuration Manager utility makes two changes to the server that stop networking functionality if auditable events cannot be logged. The first change is the addition of the following registry key:

Key: \CurrentControlSet\Control\Lsa
Value: CrashOnAuditFail
Type: REG_DWORD
Data Value: 1

This key prevents auditable activities when the Security log becomes full.

The second change is the setting for the log files in Event Viewer. The Log File Wrapping setting is changed to Do Not Overwrite Events (Clear Log Manually).

With these two settings in place, the server shuts down all auditable processes (causing Remote Procedure Call, or RPC, to stop working) when the Security event log becomes full.

RESOLUTION

Use either of the following methods to work around this problem:

Method 1: Remove the CrashOnAuditFail Value

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

Use Registry Editor (Regedt32.exe) to delete the CrashOnAuditFail value from the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\

After you make this change, quit Registry Editor and restart the computer to cause the change to take effect.

Method 2: Change the Event Log Settings

Start Event Viewer.

On the Log menu, click Log Settings.

In the Settings dialog box, you can either increase the size of the Security log, or change the Log File Wrapping setting to Overwrite events as needed.

MORE INFORMATION

For additional information about the CrashOnAuditFail value, click the article numbers below to view the articles in the Microsoft Knowledge Base:

Q140058 How to Prevent Auditable Activities When Security Log Is Full

Q178208 CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen

Additional query words:

Keywords : kbenv kberrmsg
Version : winnt:4.0,4.0 SP1,4.0 SP2,4.0 SP3,4.0 SP4,4.0 SP5
Platform : winnt
Issue type : kbprb