Applies to: Windows Server 2016 to 2025 and Windows 10 and 11 (port facts from Microsoft’s service and port requirements)
TCP port 135 is the RPC Endpoint Mapper (RPC-EPMAP) of Windows. Many Windows services use Remote Procedure Call (RPC): a client first asks port 135 which port the service it wants is using, and then connects to that port. According to Microsoft, those dynamic ports come from the range 49152 to 65535 on current Windows versions.
Which services use it
Microsoft’s port list shows TCP 135 for, among others: Active Directory and domain controllers, Group Policy, WMI and remote management, Distributed File System (DFS), certificate services, the print spooler, failover clustering, Hyper-V management and the Remote Desktop licensing and connection broker roles. The Windows service behind it is Remote Procedure Call (RPC); don’t disable it, Windows depends on it.
Should it be open to the internet?
No. A single Windows server that only offers websites or Remote Desktop to the internet doesn’t need port 135 reachable from outside. Exposed RPC has been used by worms and attackers for years, and it reveals information about the server. Keep it for your internal network or VPN only, and block the 49152 to 65535 range from the internet as well.
Check whether it is listening and reachable
Get-NetTCPConnection -LocalPort 135 -State Listen # on the server netstat -ano | findstr :135 # the same in Command Prompt Test-NetConnection 203.0.113.10 -Port 135 # from another computer
TcpTestSucceeded : True from an outside computer means the port is reachable from the internet.
Block it in Windows Defender Firewall
Windows Firewall blocks unsolicited inbound traffic unless a rule allows it. Check that no enabled inbound rule allows port 135 from any address:
Get-NetFirewallPortFilter -Protocol TCP | Where-Object LocalPort -eq 135 |
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' } |
Select-Object DisplayName, Profile, Action
To be explicit, add a block rule for the public profile (block rules win over allow rules):
New-NetFirewallRule -DisplayName "Block RPC 135 from internet" -Direction Inbound -Protocol TCP -LocalPort 135 -Profile Public -Action Block
If you need RPC between servers (for example to manage them remotely), allow it only from those IP addresses, or over a VPN.
Related ports
- TCP 445 (SMB, file sharing): also keep it off the internet.
- TCP 3389 (Remote Desktop): restrict it to your IP address; see RDP port 3389.
More firewall commands: PowerShell commands. Running Windows in the cloud: Windows VPS.
Official documentation: Microsoft: service overview and network port requirements.
Ucartz services for this topic
- Hire an expert: engineers per 15 minutes, per hour or per month, with no contract.
- Server management: on-demand administration, hardening, migrations and monitoring.
