Port 135 — TCP
TCP port 135 hosts Microsoft RPC Endpoint Mapper, which directs Windows clients to available RPC services. Applications such as WMI and DCOM may then continue on dynamic RPC ports that also need to be considered during troubleshooting.
What is port 135 used for?
An RPC client can contact the Endpoint Mapper on TCP 135 to discover the endpoint for a requested service. The application may then communicate over a different, dynamically assigned RPC port.
A successful port 135 test does not prove that WMI, DCOM or another RPC application works end to end: the required dynamic endpoints may still be blocked.
Transport protocol
TCP
Security precautions
This is a sensitive Windows infrastructure service. Do not expose it directly to the Internet.
Should we open this port in the firewall?
Limit TCP 135 to the networks and hosts that require Windows RPC. For remote administration, restrict sources and destinations and account for the dynamic RPC ports required by the application. Opening only 135 may be insufficient; opening a broad range without an identified need is also inappropriate.
How do I check this port?
On the Windows server, check the listener with Get-NetTCPConnection -LocalPort 135 -State Listen or netstat -ano | findstr :135. From the client, Test-NetConnection SERVER -Port 135 checks TCP connectivity.
- Confirm that TCP 135 is reachable.
- Identify the failing RPC application and reproduce its request.
- If 135 works but the application fails, check the dynamic RPC range permitted between the hosts.
- Inspect Windows logs and firewall rules for the affected service.
FAQ — port 135 / Microsoft RPC Endpoint Mapper
Why is port 135 open while my RPC call fails?
The client may reach the Endpoint Mapper on 135 and then be directed to a dynamic RPC endpoint that is blocked or unavailable.
Is port 135 enough for WMI or DCOM?
Not always. These applications may require dynamic RPC ports after initial discovery on 135.
Should port 135 be exposed to the Internet?
Direct exposure is generally unnecessary for Windows administration. Prefer controlled network access through a VPN or another secure administration mechanism.