PORTInternal onlyIANA assigned
Port 135RPC Endpoint Mapper (DCOM)
Port 135 is the Microsoft RPC Endpoint Mapper (epmap). A client asks it which dynamic port a given RPC service is listening on, then connects to that port. WMI, DCOM, Active Directory replication and many Windows management tools depend on it. It is essential inside a Windows network and must never be reachable from the internet.
What port 135 is used for
Windows builds much of its management plumbing on Remote Procedure Call (RPC). Because dozens of RPC services run on a machine and cannot all share one port, Windows starts an endpoint mapper on port 135. The sequence for any RPC client is:
- Connect to TCP 135 on the target and ask for the interface it needs (for example WMI).
- Receive the dynamic port on which that service is currently listening.
- Open a second connection to that dynamic port and do the actual work.
Services that go through this process include WMI and DCOM, Active Directory replication, the Task Scheduler and Service Control Manager remote interfaces, Outlook's classic MAPI/RPC connection to Exchange, and the Distributed Transaction Coordinator.
The dynamic port range
Since Windows Vista and Server 2008 the dynamic RPC range is TCP 49152–65535 (earlier versions used 1025–5000). A firewall that allows 135 but blocks the dynamic range lets the mapping succeed and the real call fail, which produces confusing "RPC server unavailable" errors. The range can be narrowed on the server side, and Microsoft documents how, so that firewalls need to allow fewer ports. See ephemeral ports.
Security considerations
Port 135 has a long history of internet-facing exploitation: the Blaster worm of 2003 spread through an RPC vulnerability on this port. The modern rule is simple:
- Never expose 135 to the internet. ISPs and cloud providers frequently block it anyway.
- Block it on the Public firewall profile, which Windows does by default.
- Inside the network, allow it only where management is needed and pair it with the dynamic range or a restricted equivalent.
- Authentication still applies. An open 135 does not grant access; RPC interfaces require Windows authentication and authorisation. Exposure matters because of unpatched vulnerabilities and credential attacks, not because 135 is an open door.
How to check port 135
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :135A line in the LISTENING state means a local program has bound port 135; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :135 or lsof -i :135.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection server01 -Port 135TcpTestSucceeded : True means the remote system accepted a TCP connection on port 135. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
List what the endpoint mapper is advertising on the local machine, if you have PortQry installed:
portqry -n 127.0.0.1 -e 135Firewall considerations
Windows Defender Firewall allows inbound 135 on the Domain and Private profiles for the management rule groups that need it (WMI, Remote Service Management, Remote Scheduled Tasks). Enable only those rule groups you use, and keep the Public profile blocking it.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 135 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Can I close port 135 on a Windows PC?
Not by stopping the service; RpcSs is required for Windows to function. You can block inbound 135 with the firewall, which is exactly what the Public profile does by default. Inside a domain, blocking it breaks remote management, WMI queries and Group Policy features.
Why does WMI need more than port 135?
Port 135 only tells the client where the WMI service is listening. The actual conversation happens on a dynamic port in the 49152–65535 range. Firewalls between management hosts and targets must allow that range, or the range can be restricted via DCOM settings.
What is the difference between 135 and 445?
Port 445 carries SMB, and RPC can also travel inside SMB named pipes. Port 135 is the endpoint mapper for RPC over TCP. Many management tasks use both.