Resolve Windows Server DC error: Invalid service type RpcSs

Using the dcdiag utility while transitioning from Windows Server 2003 to Windows 2008 domain controllers, Scott Lowe uncovered an error and found its solution.

I spent quite a bit of time tracking down what appeared to be an error. Maybe my journey will save you a little time and frustration.

Recently, I had the good fortune to be working on a domain controller upgrade project for a client. The person that had been working on the project had departed the company, and I was asked to come in and complete the project.

The goal of the project was to decommission that organization's existing Windows Server 2003-based domain controllers in favor of newly installed Windows Server 2008 R2 domain controllers. The dearly departed had gotten to a point where the 2008 R2 domain controllers and the 2003 domain controllers were installed and ready, but, given my nature, I wanted to run my own health checks on Active Directory to make sure that things were really ready to go.

To do so, I manually reviewed the AD-related DNS entries and found some stale items that needed to be manually removed in the AD folders. Once the obvious cleanup was done, I made liberal use of the dcdiag utility. Dcdiag is a utility that's built into Windows Server to analyze the current health and state of the directory service and the health of domain controllers. It's not a silver bullet, but it certainly provides a wealth of information which administrators can use as a starting point in any troubleshooting that might need to take place.

I ran dcdiag from one of the new domain controllers and used the /a switch with the commands that I sent. /a tells dcdiag to run its tests on all of the domain controllers in the site. It's certainly easier than performing the same action on every individual domain controller.

However, on two of the domain controllers, I received the following error:

Invalid service type: RpcSs on <domain controller name> current value

So, wanting to track down the cause, I turned to a search engine and looked for potential causes for this error, which was occurring on both of the remaining Windows 2003 domain controllers.

In my search, I found some advice that suggested changing the RPCSS service on the Windows 2003 domain controllers to run as "shared" rather than "own". In Windows 2003, the default run type for the RPCSS service is own while in Server 2008, it's shared. This has to do with the way that the service shares (or does not share) process space with other services.

I don't like to make random changes on domain controllers without a good reason and the guidance that the fix to this problem is to just change the process type on the existing domain controllers just didn't feel quite right, so I kept up my search and discovered a Microsoft Knowledgebase article on the topic.

The fix: Do nothing. Ignore the error and move on. This error message is expected behavior when dcdiag is run from a Windows 2008 domain controller against a Windows 2003 DC.

That's one thing that I've learned about dcdiag over the years. It's a great tool to provide guidance, but it's not the definitive guide to everything in your environment. And, before you make what appears to be a simple change, check it out a bit more, and you might just save yourself some hassle.