4.6.3. Well-known MSRPC named pipes

The following table gives a list of named pipes that are used as endpoints by Windows RPC services. The interface identifier associated to each named pipe represents the service typically accessed when a given named pipe is used.

However, due to the fact that any endpoint in a given process can be used to reach any RPC service, it is possible to use multiple RPC services using a single named pipe endpoint.

Table 4.2. Named pipes used by MSRPC servers

Named pipeDescriptionService or processInterface identifier
atsvcatsvc interface (Scheduler service)mstask.exe1ff70682-0a51-30e8-076d-740be8cee98b v1.0
AudioSrvAudioSrv interface (Windows Audio service)AudioSrv3faf4738-3a21-4307-b46c-fdda9bb8c0d5 v1.0
browser (ntsvcs alias)browser interface (Computer Browser service)Browser6bffd098-a112-3610-9833-012892020162 v0.0
certICertPassage interface (Certificate services)certsrv.exe91ae6020-9e3c-11cf-8d7c-00aa00c091be v0.0
Ctx_Winstation_API_Servicewinstation_rpc interfacetermsrv.exe5ca4a760-ebb1-11cf-8611-00a0245420ed v1.0
DAV RPC SERVICEdavclntrpc interface (WebDAV client service)WebClientc8cb7687-e6d3-11d2-a958-00c04f682e16 v1.0
dnsserverDnsServer interface (DNS Server service)dns.exe50abc2a4-574d-40b3-9d66-ee4fd5fba076 v5.0
epmapperepmp interface (RPC endpoint mapper)RpcSse1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0
eventlog (ntsvcs alias)eventlog interface (Eventlog service)Eventlog82273fdc-e32a-18c3-3f78-827929dc23ea v0.0
HydraLsPipeTerminal Server Licensinglserver.exe3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0
InitShutdownInitShutdown interfacewinlogon.exe894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0
keysvcIKeySvc interface (Cryptographic services)CryptSvc8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0
keysvcICertProtect interface (Cryptographic services)CryptSvc0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0
locatorNsiS interface (RPC Locator service)locator.exed6d70ef0-0e3b-11cb-acc3-08002b1d29c4 v1.0
llsrpcllsrpc interface (Licensing Logging service)llssrv.exe342cfd40-3c6c-11ce-a893-08002b2e9c6d v0.0
lsarpc (lsass alias)lsarpc interfacelsass.exe12345778-1234-abcd-ef00-0123456789ab v0.0
lsarpc (lsass alias)dssetup interfacelsass.exe3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0
msgsvc (ntsvcs alias)msgsvcsend interface (Messenger service)messenger5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
nddeapinddeapi interface (NetDDE service)netdde.exe2f5f3220-c126-1076-b549-074d078619da v1.2
netdfsnetdfs interface (Distributed File System service)Dfssvc4fc742e0-4a10-11cf-8273-00aa004ae673 v3.0
netlogon (lsass alias)netlogon interface (Net Logon service)Netlogon12345678-1234-abcd-ef00-01234567cffb v1.0
ntsvcspnp interface (Plug and Play service)PlugPlay8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0
plugplaypnp interface (Plug and Play Windows Vista service)PlugPlay8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0
policyagentPolicyAgent interface (IPSEC Policy Agent (Windows 2000))PolicyAgentd335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5
ipsecwinipsec interface (IPsec Services)PolicyAgent12345678-1234-abcd-ef00-0123456789ab v1.0
ProfMapApipmapapi interfacewinlogon.exe369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0
protected_storageIPStoreProv interface (Protected Storage)lsass.exec9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0
ROUTERRemote Accessmprdim.dll8f09f000-b7ed-11ce-bbd2-00001a181cad v0.0
samr (lsass alias)samr interfacelsass.exe12345778-1234-abcd-ef00-0123456789ac v1.0
scerpcSceSvcservices.exe93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0
SECLOGONISeclogon interface (Secondary logon service)seclogon12b81e99-f207-4a4c-85d3-77b42f76fd14 v1.0
SfcApisfcapi interface (Windows File Protection)winlogon.exe83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0
spoolssspoolss interface (Spooler service)spoolsv.exe12345678-1234-abcd-ef00-0123456789ab v1.0
srvsvc (ntsvcs alias)srvsvc interface (Server service)services.exe (w2k) or svchost.exe (wxp and w2k3)4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0
ssdpsrvssdpsrv interface (SSDP service)ssdpsrv4b112204-0e19-11d3-b42b-0000f81feb9f v1.0
svcctl (ntsvcs alias)svcctl interface (Services control manager)services.exe367aeb81-9844-35f1-ad32-98f038001003 v2.0
tapsrvtapsrv interface (Telephony service)Tapisrv2f5f6520-ca46-1067-b319-00dd010662da v1.0
trkwkstrkwks interface (Distributed Link Tracking Client)Trkwks300f3532-38cc-11d0-a3f0-0020af6b0add v1.2
W32TIME (ntsvcs alias)w32time interface (Windows Time (Windows 2000 and XP))w32time8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1
W32TIME_ALTw32time interface (Windows Time (Windows Server 2003, Windows Vista))w32time8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1
winlogonrpcGetUserToken interfacewinlogon.exea002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0
winregwinreg interface (Remote registry service)RemoteRegistry338cd001-2244-31f1-aaaa-900038001003 v1.0
winspipewinsif interface (WINS service)wins.exe45f52c28-7f9f-101a-b52b-08002b2efabe v1.0
wkssvc (ntsvcs alias)wkssvc interface (Workstation service)services.exe (w2k) or svchost.exe (wxp and w2k3)6bffd098-a112-3610-9833-46c3f87e345a v1.0