Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example:

Port   Serv  Process name
49152, msrpc [wininit.exe]
49153, msrpc [svchost.exe, Eventlog]
49154, msrpc [svchost.exe, Schedule]
49155, msrpc [lsass.exe]
49157, msrpc [services.exe]
49159, msrpc [svchost.exe, PolicyAgent]

For security reasons, I would like to close any listening service that is not needed, or at least block the ports in question using the Windows FW.

I realize that the processes above are system processes that I cannot close, but perhaps there is some configuration that can be done to prevent them from listening?

Lastly, not sure if relevant, but we do not use any domains or Active Directory - only a workgroups against a Samba server.

So, my questions are:

  1. What are the listening services needed for in general?
  2. In my scenario, can I disable them somehow (=make them not listen)?
  3. If #2 is not doable, can I safely block them with the FW?

Thanks.

share|improve this question
    
This link has some good info about how Windows uses a portmapper for RPC: etutorials.org/Networking/network+security+assessment/… –  adric Jul 26 '13 at 18:41
    
Thanks for the link, but it appears to mainly deal with port 135, etc. not the high 49000+ ports listed above. Any info on this particular usage (seems to have started with Windows 7)? –  Jim Balo Jul 26 '13 at 19:17

1 Answer 1

A variety of Windows services listen on dynamic RPC ports, like you found out. These usually correspond to services in the Services list. However, some of them are services you really don't want to turn off. When that happens, you need to use the build in Windows firewall to prevent access. They're still listening, but nothing can get at them, which allows them to pass network audits.

The MS Dynamic RPC range did change as of Vista, to 49152-65535. You can even adjust the range if you need to:

netsh int ipv4 set dynamic tcp start=49152 number=50  # yields a range of 49152-49202
share|improve this answer
    
In the Windows Firewall, are these dynamic local TCP ports all named "RPC Dynamic Endpoint"? Are "RPC Endpoint Mapper" also included in this range? Thanks. –  Jim Balo Jul 27 '13 at 5:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.