# Evaluate RPC anonymous-client restrictions against application dependencies

> What should be tested before changing RestrictRemoteClients?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:16:56+00:00
- Modified: 2026-09-08T18:17:13+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

What should be tested before changing RestrictRemoteClients?

## Potentially affected

Use this review when considering an RPC interface restriction on Windows Server.

## DSE recommendation

Ask application owners to identify required remote operations and the identities used for them.

## Article

## Source facts

Microsoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict).

## Applicability

Use this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.

## DSE recommendation

Ask application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.

## Verification

Run the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.

## Official references

[Microsoft Learn: RPC Interface Restriction for Windows Server](https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict). Source reviewed September 8, 2026.

## Primary reference

- Name: RPC Interface Restriction for Windows Server
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Evaluate RPC anonymous-client restrictions against application dependencies,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-015-evaluate-rpc-anonymous-client-restrictions-against-application-dependencies/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.