Evaluate RPC anonymous-client restrictions against application dependencies

Source facts

Microsoft documents RestrictRemoteClients as a system-wide control that can limit anonymous remote access to RPC interfaces, subject to exceptions. Applications expecting anonymous remote RPC calls may fail when the restriction is used; Microsoft also warns that DCOM applications may be affected. The setting adds RPC security checks even for interfaces without a registered security callback. Named-pipe RPC through ncacn_np is exempt from these restrictions. Enabling the key causes RPC calls over connectionless protocols to fail. Microsoft documentation.

Applicability

Use this review when considering an RPC interface restriction on Windows Server. Identify the current setting, affected applications, and calling systems. Review the precise documented values and exceptions before choosing a configuration.

DSE recommendation

Ask application owners to identify required remote operations and the identities used for them. Build an approved test matrix containing legitimate workflows and the anonymous access the proposed setting is meant to restrict. Record the prior registry configuration and an authorized restoration procedure. Pilot the setting with the people who can recognize application-level failures, not solely with a server administrator.

Verification

Run the agreed remote workflows after the change and retain authentication context, timestamps, and results. Investigate DCOM or RPC errors against the prechange observations. Verify the intended restriction separately from legitimate application success. Record every required exception and owner before extending the configuration to other servers.

Official references

Microsoft Learn: RPC Interface Restriction for Windows Server. Source reviewed September 8, 2026.