The following table gives a list of named pipes that are used as endpoints by Windows RPC services. The interface identifier associated to each named pipe represents the service typically accessed when a given named pipe is used.
However, due to the fact that any endpoint in a given process can be used to reach any RPC service, it is possible to use multiple RPC services using a single named pipe endpoint.
Table 4.2. Named pipes used by MSRPC servers
| Named pipe | Description | Service or process | Interface identifier |
|---|---|---|---|
| atsvc | atsvc interface (Scheduler service) | mstask.exe | 1ff70682-0a51-30e8-076d-740be8cee98b v1.0 |
| AudioSrv | AudioSrv interface (Windows Audio service) | AudioSrv | 3faf4738-3a21-4307-b46c-fdda9bb8c0d5 v1.0 |
| browser (ntsvcs alias) | browser interface (Computer Browser service) | Browser | 6bffd098-a112-3610-9833-012892020162 v0.0 |
| cert | ICertPassage interface (Certificate services) | certsrv.exe | 91ae6020-9e3c-11cf-8d7c-00aa00c091be v0.0 |
| Ctx_Winstation_API_Service | winstation_rpc interface | termsrv.exe | 5ca4a760-ebb1-11cf-8611-00a0245420ed v1.0 |
| DAV RPC SERVICE | davclntrpc interface (WebDAV client service) | WebClient | c8cb7687-e6d3-11d2-a958-00c04f682e16 v1.0 |
| dnsserver | DnsServer interface (DNS Server service) | dns.exe | 50abc2a4-574d-40b3-9d66-ee4fd5fba076 v5.0 |
| epmapper | epmp interface (RPC endpoint mapper) | RpcSs | e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0 |
| eventlog (ntsvcs alias) | eventlog interface (Eventlog service) | Eventlog | 82273fdc-e32a-18c3-3f78-827929dc23ea v0.0 |
| HydraLsPipe | Terminal Server Licensing | lserver.exe | 3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0 |
| InitShutdown | InitShutdown interface | winlogon.exe | 894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0 |
| keysvc | IKeySvc interface (Cryptographic services) | CryptSvc | 8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0 |
| keysvc | ICertProtect interface (Cryptographic services) | CryptSvc | 0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0 |
| locator | NsiS interface (RPC Locator service) | locator.exe | d6d70ef0-0e3b-11cb-acc3-08002b1d29c4 v1.0 |
| llsrpc | llsrpc interface (Licensing Logging service) | llssrv.exe | 342cfd40-3c6c-11ce-a893-08002b2e9c6d v0.0 |
| lsarpc (lsass alias) | lsarpc interface | lsass.exe | 12345778-1234-abcd-ef00-0123456789ab v0.0 |
| lsarpc (lsass alias) | dssetup interface | lsass.exe | 3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0 |
| msgsvc (ntsvcs alias) | msgsvcsend interface (Messenger service) | messenger | 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0 |
| nddeapi | nddeapi interface (NetDDE service) | netdde.exe | 2f5f3220-c126-1076-b549-074d078619da v1.2 |
| netdfs | netdfs interface (Distributed File System service) | Dfssvc | 4fc742e0-4a10-11cf-8273-00aa004ae673 v3.0 |
| netlogon (lsass alias) | netlogon interface (Net Logon service) | Netlogon | 12345678-1234-abcd-ef00-01234567cffb v1.0 |
| ntsvcs | pnp interface (Plug and Play service) | PlugPlay | 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0 |
| plugplay | pnp interface (Plug and Play Windows Vista service) | PlugPlay | 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0 |
| policyagent | PolicyAgent interface (IPSEC Policy Agent (Windows 2000)) | PolicyAgent | d335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5 |
| ipsec | winipsec interface (IPsec Services) | PolicyAgent | 12345678-1234-abcd-ef00-0123456789ab v1.0 |
| ProfMapApi | pmapapi interface | winlogon.exe | 369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0 |
| protected_storage | IPStoreProv interface (Protected Storage) | lsass.exe | c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0 |
| ROUTER | Remote Access | mprdim.dll | 8f09f000-b7ed-11ce-bbd2-00001a181cad v0.0 |
| samr (lsass alias) | samr interface | lsass.exe | 12345778-1234-abcd-ef00-0123456789ac v1.0 |
| scerpc | SceSvc | services.exe | 93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0 |
| SECLOGON | ISeclogon interface (Secondary logon service) | seclogon | 12b81e99-f207-4a4c-85d3-77b42f76fd14 v1.0 |
| SfcApi | sfcapi interface (Windows File Protection) | winlogon.exe | 83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0 |
| spoolss | spoolss interface (Spooler service) | spoolsv.exe | 12345678-1234-abcd-ef00-0123456789ab v1.0 |
| srvsvc (ntsvcs alias) | srvsvc interface (Server service) | services.exe (w2k) or svchost.exe (wxp and w2k3) | 4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0 |
| ssdpsrv | ssdpsrv interface (SSDP service) | ssdpsrv | 4b112204-0e19-11d3-b42b-0000f81feb9f v1.0 |
| svcctl (ntsvcs alias) | svcctl interface (Services control manager) | services.exe | 367aeb81-9844-35f1-ad32-98f038001003 v2.0 |
| tapsrv | tapsrv interface (Telephony service) | Tapisrv | 2f5f6520-ca46-1067-b319-00dd010662da v1.0 |
| trkwks | trkwks interface (Distributed Link Tracking Client) | Trkwks | 300f3532-38cc-11d0-a3f0-0020af6b0add v1.2 |
| W32TIME (ntsvcs alias) | w32time interface (Windows Time (Windows 2000 and XP)) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 |
| W32TIME_ALT | w32time interface (Windows Time (Windows Server 2003, Windows Vista)) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 |
| winlogonrpc | GetUserToken interface | winlogon.exe | a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0 |
| winreg | winreg interface (Remote registry service) | RemoteRegistry | 338cd001-2244-31f1-aaaa-900038001003 v1.0 |
| winspipe | winsif interface (WINS service) | wins.exe | 45f52c28-7f9f-101a-b52b-08002b2efabe v1.0 |
| wkssvc (ntsvcs alias) | wkssvc interface (Workstation service) | services.exe (w2k) or svchost.exe (wxp and w2k3) | 6bffd098-a112-3610-9833-46c3f87e345a v1.0 |