Port 135 (MSRPC): What It Is and How to Secure It

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 8 November 2026.

In one sentence: Port 135 is the reception desk for Windows remote management: it does not do the work itself, it tells other computers which side door to use.

Part of our Ports and protocols library.

What runs on this port

RPC stands for Remote Procedure Call. It lets one Windows computer ask another to run a task. Microsoft Learn says many programs and services, for example Active Directory replication and the Microsoft Management Console, use RPC to talk across a network.

Port 135 runs the endpoint mapper (EPM). Microsoft explains the flow: the client first contacts TCP port 135 on the server and asks for the service it needs. The endpoint mapper replies with a dynamic port. The client disconnects and then connects to that dynamic port to do the real work. Because of that, a firewall between the two machines has to allow port 135 and the dynamic ports.

On Windows servers, port 135 is normal and needed inside the network. That is the point: it should stay inside.

Why attackers look for it

Any internet-facing service can be found by scanning, and port 135 on an exposed Windows server tells an attacker it is Windows and that RPC services are running. Inside a network, an attacker who already has a foothold can use it to see which Windows services a machine offers.

How it gets attacked

Exposed to the internet. Usually a router port-forward or a firewall rule added “to make remote management work”.
Unpatched RPC code. In April 2022 Microsoft published an advisory for CVE-2022-26809, a critical remote code execution flaw in the RPC runtime library. CISA’s alert says a remote, unauthenticated attacker could use it to take control of an affected system, and urges administrators to review Microsoft’s advisory and apply the recommended mitigations. The risk sits on machines that never had them applied.
Open dynamic ports. Opening the whole dynamic range to make RPC “just work” widens the target. Microsoft documents a registry method to restrict RPC to a defined set of ports so the firewall rule can be narrow.
Reach from inside. RPC is how Windows management tools talk to other machines, so any host an attacker controls can try to talk to port 135 on its neighbours. Segmentation limits that.

Who it affects and how badly

Sole trader to 10 staff: usually safe unless a router forward was made. If it was, one unpatched PC or server can be taken over.
10 to 50 staff (trades, estate agents, accountancy): a single office server, often managed remotely by an MSP or a friendly contractor. Worst case: a forwarded port 135 on an out-of-date server leads to ransomware and several days without files.
50 to 250 and 250 plus (manufacturing, healthcare, schools, councils): many servers and old systems that cannot be patched quickly. Worst case: one reachable Windows host becomes a stepping stone to the rest, with downtime, lost data and a personal data breach to assess.
Regulated firms (fintech, insurance, telecoms): same technical exposure, plus questions from regulators about why a management port was reachable.

What we check on a test

This is method, not a list of findings.

Whether port 135 answers from the internet on any address in scope.
From a normal staff network position, which hosts answer on 135 and whether the endpoint mapper reveals services that staff devices do not need to reach.
Whether hosts that answer have the update listed in Microsoft’s advisory for CVE-2022-26809.
Whether the firewall allows the whole dynamic port range or a restricted range.
Whether host firewalls limit RPC to management machines only.

The UK angle

The ICO guide to data security says organisations must regularly test and evaluate their security measures, with vulnerability scanning and penetration testing as examples, and treats Cyber Essentials as a base set of controls. NCSC guidance on penetration testing is a useful reminder of the limits: a test can only confirm that systems are not vulnerable to known issues on the day of the test. A patch that was missing last month is exactly the sort of thing that matters here.

How the connection works

Worked example (an illustration, not a real client)

A 40-person construction firm has one Windows server in the office. Their IT contractor opened ports on the router so he could manage the server from home. Port 135 was one of them. The server had missed several updates. An automated scan finds the open port. CISA says the attacker would not need to be authenticated. The firm loses its project files and drawings for several days. The fix is small: remove the router forward, put a VPN in front of remote management, and apply the missing updates.

How to check whether yours is exposed

Safe checks only, on systems you own:

Review router and firewall rules for inbound port 135 (TCP or UDP) from the internet. Remove any you cannot justify.
Check your asset list for Windows servers that are meant to be reachable from outside, and confirm each has a reason.
From a staff PC inside the network, Microsoft’s PortQry tool shows whether port 135 answers and which dynamic port the endpoint mapper hands out. Use it only on your own hosts.
Run the free scan at https://wolfcore.co.uk/free-web-vulnerability-scan/ to see what is visible from outside.

How to secure it

Block port 135 from the internet at the firewall and remove any router port-forward for it. This is Wolfcore’s advice.
Put remote management behind a VPN or a managed remote access tool with multi-factor authentication.
Install Windows updates promptly, including the one listed in Microsoft’s advisory for CVE-2022-26809 on any older system.
Use the Windows Firewall on each server to allow RPC only from management machines.
Where a firewall must sit between two Windows machines, restrict RPC to a defined port range using the registry settings Microsoft documents, and allow only that range plus 135. Microsoft warns that too few ports can stop services such as Netlogon, so test first.
Segment servers from ordinary staff devices so one infected PC cannot reach every server.
Keep an asset list so a forgotten server cannot sit exposed.

Frequently asked questions

Why is port 135 open on my Windows server? It runs the RPC endpoint mapper, which tells clients which dynamic port a service is using. Microsoft says services such as Active Directory replication and the Management Console rely on RPC.

Is port 135 dangerous? Inside a network it is normal. Exposed to the internet it is a risk, particularly on unpatched systems, as the CVE-2022-26809 advisory shows.

Do I need to open more than port 135 for RPC through a firewall? Yes. Microsoft says the firewall has to allow port 135 and the dynamic ports the endpoint mapper assigns.

Back to the Ports and protocols hub.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at https://wolfcore.co.uk/free-web-vulnerability-scan/ and read about penetration testing at https://wolfcore.co.uk/services/penetration-testing/.

Port 135 (MSRPC): what it is, how it is attacked and how to secure it