WhatsUp Gold - NT Service plug-in returns RPC server is unavailable

Question/Problem: I am trying to use the NT Service monitoring plug-in to check a remote service, but it always returns down.  When I turn on the debug log (using Logs | Debug Log.) and watch the poll, I see a message that says:

Failed to open the Service Control Manager on a.b.c.d.  Reason: The RPC server is unavailable.

Answer/Solution: The NT Service monitoring plug-in relies on remote procedure calls (RPC) to manipulate the services on remote systems.  Due to the complexity of Microsoft Windows client/server architecture, there are a number of reasons that the message "RPC server is unavailable" could occur. This article will give you various steps to take to isolate the problem that is occurring in your environment.

If, after following one or more of the steps in this article, the error message changes from 'RPC server is unavailable' to some other message such as 'Access denied', you now have a different problem that is security related. You can stop following these steps at that point, and start looking into things like whether the account WhatsUp Gold is running under has administrative rights on the target host, and so on.

While working through problems with this plug-in, a useful utility to have handy is PSService from System Internals. This is a freeware command line program that lets you manipulate services remotely. So as you try different diagnostic steps in this article, you can repeat the command:

psservice \\a.b.c.d query SERVICE

Where a.b.c.d is the IP address of the target host, and SERVICE is the name of the service you are checking. This program will return the exact same error messages which WUG does in the debug log, because it is using the very same API's.

Here are some things to try no matter what:

A. Is the "Server" service running on the target?  If not, type NET START SERVER at a command prompt to start it.  (You can also do this from the GUI in the Services applet in Control Panel).

B. Is the "Server" service bound to the interface on which is being polled on the target?

In NT 4.0, this is checked by opening the Network icon from Control Panel, going to the Bindings tab and selecting "all services" in the drop down. Find "Server" in the tree control, open the nodes underneath it, and make sure the relevant network connection does not have a red "no" symbol next to it.

In Windows 2000 or XP, this is checked by opening the properties for the relevant network connection. In the list marked "Components checked are used by this connection" make sure the entry "File and Print Sharing for Microsoft Networks" is present and checked. If it is not present you will have to click the Install... button to add it.

C.Is the "Workstation" service running on the WhatsUp Gold system?  If not, type NET START WORKSTATION at a command prompt to start it.  (You can also do this from the GUI in the Services applet in Control Panel).

D. Is the "Workstation" service bound to the interface which WhatsUp Gold uses to poll the target host?

In NT 4.0, this is checked by opening the Network icon from Control Panel, going to the Bindings tab and selecting "all services" in the drop down. Find "Workstation" in the tree control, open the nodes underneath it, and make sure the relevant network connection does not have a red "no" symbol next to it.

In Windows 2000 or XP, this is checked by opening the properties for the relevant network connection. In the list marked "Components checked are used by this connection" make sure the entry "Client for Microsoft Networks" is present and checked. If it is not present you will have to click the Install... button to add it.

If you have worked through all of the above, and still you are getting "RPC Server is unavailable", then the following instructions will help you narrow it down further.  To keep from having to try every possible solution, the following table will help you try only relevant solutions.  Match the Windows OS you are running at the WhatsUp Gold system on the left to the Windows OS you are running on the monitored host across the top, and try the solution numbers listed in the intersecting box:

Here are the solutions referred to in the above by number:

1. Is Port 139 being blocked?

Is a router, firewall, proxy or other filtering device between WhatsUp Gold and the target filtering TCP port 139?  (This could include software running locally on WhatsUp Gold or the target host, such as a personal firewall product). Reconfigure it to allow port 139 traffic through. 

You can check this by configuring a simple "TCP/IP Service" in WhatsUp Gold to connect to port 139 and do nothing in the script.  That will verify that the WhatsUp Gold system can connect to port 139 on the target.   If that test fails, then you know you have some issues outside of WhatsUp Gold.

To configure such a service:

• From the WhatsUp Gold main menu choose Configure | Monitors and Services.
• Select New.
• Call the new service "Port 139"
• Set the Service Type to "TCP/IP Service" and click OK.
• Set the "Network type" to "TCP" (the default).
• Set the "Port number" to 139.
• Set the "Timeout" to 5 or some other reasonable value.
• Leave the script blank, or if you are running WhatsUp Gold 7.00 specifically you may need to add a comment.

To apply this service to a host:

• Click on the host on the map and choose properties.
• Choose the Services icon.
• Choose Add.
• Choose the "Port 139" service you just defined, click OK.
• Choose OK again.
• Now let the map poll or pick "Check Now".  Wait until the poll is done if necessary.

Choose Quick Status from the host and see if the "Port 139" service is down (red).  If it is, you may have an external port filtering problem that you need to resolve.

2. Is Port 445 being blocked?

Is a router, firewall, proxy or other filtering device between WhatsUp Gold and the target filtering TCP port 445?  Reconfigure it to allow port 445 traffic through.

You can test this using the exact same procedure as diagnosis 3 above, but with 445 substituted for 139 in the instructions.

3. Is NETBIOS over TCP/IP enabled at WhatsUp Gold?

Is "NetBIOS over TCP/IP" disabled on the WhatsUp Gold box?  This is necessary for compatibility across various versions of Windows.  (The technology behind  this option is explained in the MSKB article " Direct Hosting of SMB Over TCP/IP (Q204279)").

In Windows 2000: from Control Panel, pick "Network and Internet Connections". 

In Windows XP: from Control Panel in Category View, pick "Network and Internet Connections", then near the bottom choose "Network Connections"  In Classic View just pick "Network Connections."

Continuing in either operating system:

• Find and highlight the network connection used by WhatsUp Gold, usually this is "Local Area Networking".  Pick Properties.
• In the property sheet that appears, scroll to "Internet Protocol (TCP/IP)" and highlight it.  Click the Properties. button.
• Pick Advanced. on the dialog that appears.
• Select the WINS tab on the dialog that appears.
• Make sure that "Disable NETBIOS over TCP/IP" is NOT selected.  It is recommended that you select "Enable NETBIOS over TCP/IP", but if you are using the DHCP option, make sure your DHCP server is configured to tell clients to turn this on.

4. Is NETBIOS over TCP/IP enabled at target host?

Same as 3., but on the target system.

5. Does the target have more than one IP address?

Does the target have more than one IP address?  If so, is the IP address being polled the FIRST one defined on that network card on the target.  If not, that's the problem.  See this MSKB article for why: " NetBT Supports One IP Address per NIC (Q131641)." Change the host icon in WhatsUp Gold so that its monitored IP address is the first one configured on that NIC.

6. Try Microsoft's troubleshooting tips

Try the steps outlined in the MSKB article "Troubleshooting "RPC Server is Unavailable" in Windows (Q224370)".  You can skip the step in the article where you PING the target host, because WhatsUp Gold by definition did this for you.

See also:
WhatsUp Gold - How to verify that WhatsUp Gold can monitor a NT Service