1

I have a “fascinating” problem, and I can’t find anything relevant in my online searches.

I’ll try to provide as many relevant details as possible, though I am sure I will overlook some stuff, so feel free to ask –

Summary:
Since moving to Windows 11, some (not all) of our domain machines will show an RPC Failed message, at which point the computer will basically cease functioning properly and automatically reboot 60 seconds later.

There are two scenarios where this (sometimes) occurs: (1) When a user is attempting to login to a domain computer but there is no connection to the domain network (e.g. a laptop without WiFi or on a different WiFi – having internet doesn’t change it if it’s not the domain network, or a desktop with ethernet down for some reason), or (2) when entering admin credentials in a privilege elevation prompt (in this case, being on the domain network doesn’t help).

Additional Details:

Not sure what is relevant, so I’ll just list some stuff:

  • The computers are local AD joined, not Azure
  • The RPC service is set to start automatically
  • The issues seem to happen consistently on particular computers, but there is no discernible/consistent configuration difference between the ones that have the issue and the ones that don’t… that I can tell. There is an off chance that every computer with the issue was a Win10 → Win11 upgrade, but I can’t say that definitively.
  • No computers on Windows 10 have this issue, and some of the ones that have it now used to be fine when they were Win 10 machines.
  • The user profiles being logged into are cached, i.e. the issue isn’t that the computer can’t load the user profile without a connection because these users used to be fine logging in off-domain on Win10
  • DCs are Windows Server 2022
  • I have run DISM and SFC on the machines in question, there shouldn’t be any corruption issues at play.
6 Spice ups
2

What does the Event Log show for the RPC failure?

3

Check the following services, please:

Remote Procedure Call (RPC) - Automatic
DCOM Server Process Launcher - Automatic
Remote Procedure Call (RPC) Locator - Manual

If you have to change a setting, please reboot to enter a fresh system.

4

The only events during the timeframe are two Informational events occurring with the same timestamp:

Source: IsolatedUserMode
Event ID: 2
General: Secure Trustlet Id 0 and Pid 0 stopped with status STATUS_SUCCESS.

and

Source: User32
Event ID: 1074
General: The process wininit.exe has initiated the restart of computer XXXXXX on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process ‘C:\WINDOWS\system32\lsass.exe’ terminated unexpectedly with status code -1073740791. The system will now shut down and restart.

5

Thanks for the response. These are all set like this already.

6

Any follow up to this issue? I’m experiencing the identical issue after moving over to WIn11

7

I have yet to determine a cause. I combed through and re-organized my GPOs without any change.

8

We’ve had partial success with this system by unjoining it from the domain, clearing out the network config and re-installing the network adapters and then rejoining the domain. After that I was able to elevate processes. After a few weeks the issue mysteriously returned though. If I log into the PC with an account with higher privileges, I can at least install applications and make changes for all users there. That did not work before. Workable but not ideal.

A workaround was somewhat found for a home PC that got the RPC error when trying to log into a domain account. A local admin account is able to log in and then connect to the domain via Pulse Secure. Then you can switch users to the Domain user account. That system still has issue with elevation but it is mostly un-needed for remote work.

So, the problem persists in a different form. No real solution right now other than a complete re-install of Win11. Fresh Win11 installs do not appear to have this issue. Only Win11 systems that were migrated to the new corporate domain.

If anyone does uncover a clean solution please post it. It would be great to not lose a big chuck of time re-installing everything on this development system.

1 Spice up
9

I have been having this issue even on systems that were clean Win 11 installs, so I don’t think that is a fix on this end.

10

is anybody else seeing the LSASS service crash after the first attempt? or can anybody log in with a local user after getting the RPC issue? i’m also seeing the power icon / button in the lower left stop working after the RPC error.

11

Yes you lose the option to switch users or power down the PC once the error occurs. You have to wait 60s and the PC will self-reboot

1 Spice up
12

@spiceuser-jo3tl ​ et al

I believe I have narrowed this down to an issue with Sophos Endpoint. I recently started seeing a good number of [HIGH] severity alerts from Sophos endpoint, e.g.:

What happened: We prevented credential theft in Windows Problem Reporting
Where it happened: [redacted]
Path: C:\Windows\System32\WerFault.exe
What was detected: CredGuard
User associated with device: [redacted]
How severe it is: High
What Sophos has done so far: We prevented the credential theft and ran a scan to clean up the computer.
What you need to do: Investigate the cause of the alert. When you are sure the system is clean, acknowledge the alert.

Well, today I got two of these coinciding with two instances of this error. I don’t know the details of the cause, but I am pretty confident at this point that Sophos is to blame. Perhaps AV is to blame in other instances as well, even if the vendor isn’t Sophos?

13

Another follow-up – it’s not Sophos Endpoint. Removing it completely did not change anything. Back to square one.

14

has anybody figured out what’s causing this? the only way i have found to resolve this is to do a full (online) reset.

15

I ran into this today for the first time. Anyone have any updates? We are using Sophos. I cannot log into the computer with either domain or local user accounts. It is offsite, so I am working thru a remote connection.