Fix 0XC0030009: Null reference pointer passed to stub

What 0XC0030009 actually means

This error code shows up when Windows tries to make a remote procedure call (RPC) and the server sends back a null pointer where it should have sent a real one. Think of it like calling your buddy and asking for his address, but he just stays silent. The RPC runtime can't handle that.

I see this most often on Windows Server 2016 and 2019 boxes running Exchange or SQL Server, but it also happens on domain controllers. The trigger is usually a service restart or a big update that changes how RPC endpoints talk to each other.

First fix: Quick check (30 seconds)

Before you go digging into logs, try this. It sounds dumb but it works more often than you'd think.

Open Event Viewer (eventvwr.msc)
Look under Windows Logs > System, filter by Event ID 5719 or 1000.
If you see something about RPC endpoint not registered, note the service name.

Then restart that specific service. For example, if it's the Netlogon service, run in an admin command prompt:

net stop netlogon && net start netlogon

Had a client last month whose print queue died after a Windows update—restarting the Print Spooler fixed the same 0XC0030009 error instantly.

Second fix: Check RPC port range (5 minutes)

If the quick restart didn't work, the next suspect is a port range issue. Windows RPC uses dynamic ports by default (1024-5000 on older OS, 49152-65535 on newer). If something blocks those ports, the call fails.

Run this command to see the current port range:

netsh int ipv4 show dynamicport tcp

If the range looks weird or too small, reset it:

netsh int ipv4 set dynamicport tcp start=49152 num=16384

Then reboot the server. I've fixed this on a dozen Exchange 2019 installs where some security tool locked down the ports.

Third fix: Register the RPC endpoint manually (5-10 minutes)

Sometimes the service that should register its endpoint doesn't do it right. You can force it.

First, find the problematic service. Open Services.msc, look for any service with a status of "Stopped" that should be running—especially ones like Remote Registry, DCOM Server Process Launcher, or RPC Endpoint Mapper.

Right-click each and select Start. Then right-click again, go to Properties, and set Startup Type to Automatic.

If that doesn't stick, you can manually trigger the endpoint registration using:

net stop RpcEptMapper && net start RpcEptMapper

Wait 30 seconds, then test the app that was failing.

Fourth fix: Deep dive—check DCOM permissions (15+ minutes)

This is the big one. The null pointer often comes from DCOM trying to launch a component but the security doesn't allow it. I've seen this on servers where someone tightened security too much.

Open Component Services (dcomcnfg.exe), then go to Component Services > Computers > My Computer > DCOM Config. Right-click My Computer, go to Properties, then the COM Security tab.

Under Access Permissions, click Edit Limits. Make sure these are present:

ANONYMOUS LOGON: Remote Access (on older Windows, not always needed)
Everyone: Local Access and Remote Access
SYSTEM: Full control

Same for Launch and Activation Permissions—make sure the users that need it (like NETWORK SERVICE) have Local Launch and Remote Launch.

Apply, then restart the RPC services:

net stop RpcSs && net start RpcSs

I spent three hours on a client's Server 2016 where some admin had removed Everyone from the launch permissions, and this fix sorted it.

Last resort: Registry hack for null pointer batching

If nothing above works, there's a registry setting that can help. It tells Windows not to batch null pointers during RPC marshaling—sounds technical, but it's a simple edit.

Open regedit, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\

Create a new DWORD (32-bit) called NullPointerBatchSize. Set it to 0. Then restart. This forces the RPC runtime to handle each pointer individually instead of batching them, which avoids the null reference issue in some edge cases.

I only recommend this if you're desperate—like the client whose backup software kept failing after a patch Tuesday. Worked there.

When to call in help

If you've tried all four steps and the error still shows up, it might be a driver issue or a deeply corrupted system file. Run SFC /scannow and DISM /online /cleanup-image /restorehealth. If those find nothing, consider reinstalling the app that triggers the error. Had a case where a stale AV driver caused this on every reboot.