> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/reference/script-reference/rpc-and-service-management-scripts.md).

# RPC & Service Management Scripts

These examples are useful when you need to identify services, endpoints, SIDs, host roles, or basic network reachability.

## Script List

* `rpcdump.py` -- Dump RPC endpoints from the endpoint mapper
* `rpcmap.py` -- Probe for RPC interfaces and their operations
* `services.py` -- Interact with Windows services (SCM)
* `reg.py` -- Remote registry operations
* `registry-read.py` -- Read offline registry hive files
* `sambaPipe.py` -- Interact with Samba named pipes
* `exchanger.py` -- Exchange Web Services operations
* `net.py` -- net.exe-style operations (shares, sessions, users)

## Main Scripts

| Script             | Purpose                                           | What to study                             |
| ------------------ | ------------------------------------------------- | ----------------------------------------- |
| `rpcdump.py`       | Dumps registered RPC endpoints                    | Endpoint mapper binding and enumeration   |
| `rpcmap.py`        | Maps listening MSRPC interfaces                   | RPC interface discovery                   |
| `services.py`      | Service Control Manager client                    | RPC over SMB, service listing and control |
| `reg.py`           | Remote registry manipulation                      | Registry RPC, hive/key/value operations   |
| `registry-read.py` | Offline registry hive reader                      | Registry parsing without live RPC         |
| `sambaPipe.py`     | Samba named pipe interaction                      | Named pipe behavior                       |
| `exchanger.py`     | Exchange Web Services operations                  | EWS protocol handling                     |
| `net.py`           | Windows-like administration helper                | Shares, sessions, users operations        |
| `lookupsid.py`     | Brute-forces or resolves SIDs through LSARPC/SAMR | SID formats and name resolution           |
| `samrdump.py`      | Enumerates SAMR information                       | SAMR RPC calls                            |
| `machine_role.py`  | Retrieves host role and primary domain details    | Workstation/domain role discovery         |
| `DumpNTLMInfo.py`  | Dumps NTLM negotiation information from services  | Protocol negotiation inspection           |
| `getArch.py`       | Determines remote architecture                    | Remote service probing                    |
| `ping.py`          | ICMP ping helper                                  | Raw packet basics                         |
| `ping6.py`         | IPv6 ICMP ping helper                             | IPv6 packet basics                        |
| `rdp_check.py`     | Checks RDP authentication behavior                | RDP connection checks                     |
| `mqtt_check.py`    | Checks MQTT service behavior                      | Non-Windows protocol probing              |
| `tstool.py`        | Terminal Services manipulation                    | RDP/Terminal Services RPC patterns        |

## RPC Endpoint Discovery

`rpcdump.py` talks to the endpoint mapper and lists registered interfaces.

```bash
python examples/rpcdump.py ncacn_ip_tcp:files01
python examples/rpcdump.py ncacn_np:files01[\pipe\epmapper]
```

This script is one of the best references for DCE/RPC transport strings.

## RPC Interface Mapping

`rpcmap.py` checks for listening MSRPC interfaces.

```bash
python examples/rpcmap.py ncacn_ip_tcp:files01
```

Use it when you are learning how UUIDs, versions, bindings, and transports fit together.

## SID Lookup

`lookupsid.py` resolves SIDs and can enumerate RID ranges.

```bash
python examples/lookupsid.py CONTOSO/alice:'Passw0rd!'@dc01.contoso.local
```

This script is a practical reference for SID anatomy:

```
S-1-5-21-domain-identifier-rid
```

The RID at the end identifies the account or group inside the domain.

## SAMR Enumeration

`samrdump.py` enumerates users and groups through SAMR.

```bash
python examples/samrdump.py CONTOSO/alice:'Passw0rd!'@dc01.contoso.local
```

Compare this with LDAP enumeration scripts. Both can describe directory identities, but they do it through different protocols and permissions.

## Network Helpers

`ping.py`, `ping6.py`, `getArch.py`, `rdp_check.py`, and `DumpNTLMInfo.py` are small but valuable examples. They show how to build focused tools that answer one question clearly.

## Considerations

RPC examples often fail because of firewall rules, endpoint restrictions, named pipe access, or authentication level requirements. When debugging, identify the transport first, then the binding, then the authentication state.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.impacket.wiki/reference/script-reference/rpc-and-service-management-scripts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.