{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
        "slug": "dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/"
        },
        "title": "Evaluate RPC anonymous-client restrictions against application dependencies",
        "summary": "What should be tested before changing RestrictRemoteClients?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:16:56+00:00",
        "modified_at": "2026-09-08T18:17:13+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 2,
        "word_count": 235,
        "potentially_affected": "Use this review when considering an RPC interface restriction on Windows Server.",
        "dse_recommendation": "Ask application owners to identify required remote operations and the identities used for them.",
        "primary_source": {
            "name": "RPC Interface Restriction for Windows Server",
            "url": "https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. <a href=\"https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Use this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.</p>\n<h2>DSE recommendation</h2>\n<p>Ask application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.</p>\n<h2>Verification</h2>\n<p>Run the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: RPC Interface Restriction for Windows Server</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. Microsoft documentation.\nApplicability\nUse this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.\nDSE recommendation\nAsk application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.\nVerification\nRun the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.\nOfficial references\nMicrosoft Learn: RPC Interface Restriction for Windows Server. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict).\n\n## Applicability\n\nUse this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.\n\n## DSE recommendation\n\nAsk application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.\n\n## Verification\n\nRun the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.\n\n## Official references\n\n[Microsoft Learn: RPC Interface Restriction for Windows Server](https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Evaluate RPC anonymous-client restrictions against application dependencies",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/",
                "headline": "Evaluate RPC anonymous-client restrictions against application dependencies",
                "description": "What should be tested before changing RestrictRemoteClients?",
                "abstract": "What should be tested before changing RestrictRemoteClients?",
                "articleBody": "Source facts\nMicrosoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. Microsoft documentation.\nApplicability\nUse this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.\nDSE recommendation\nAsk application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.\nVerification\nRun the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.\nOfficial references\nMicrosoft Learn: RPC Interface Restriction for Windows Server. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:16:56+00:00",
                "dateModified": "2026-09-08T18:17:13+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Evaluate RPC anonymous-client restrictions against application dependencies"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 235,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "RPC Interface Restriction for Windows Server",
                    "url": "https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict"
                }
            }
        ]
    }
}