SFC /scannow error 0x000006ba – The RPC Server is unavailable

While attempting to run a System File Check (sfc /scannow) on a Windows XP machine today I received the error 0x000006ba – The RPC Server is unavailable.  I checked the services console and saw that the RPC service was running.  After scratching my head for a few minutes, I decided that the SFC component must have been disabled (as the CD I installed from was a torrented ISO that has the latest updates).  I figured the ISO must have been modified to disable the file checker for whatever reason.

Sidenote for the haters: I have a valid license, but I was deploying about 20 refurbished machines for coworkers and didn’t have the time or desire to install all of the Windows updates that were needed to get the machines fully updated.

Anyway, so after scouring the ultranet for a little bit, I came across an nLite setting that was probably employed when creating the Windows disk I downloaded.  The settings is a registry entry to disable SFC.  It’s located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.  It’s a DWORD value titled “SfcDisable” and was set to some random hex value.  Change this to 0 and restart, and SFC should now work.  Note: There was another value called SfcDisabled which was already set to 0.  That threw me off for a moment, but then I saw the proper DWORD I was looking for, which was not already zero.

Written By drew

10 Comments on “SFC /scannow error 0x000006ba – The RPC Server is unavailable

  1. Chris Reply

    April 12, 2012 at 12:52

    This worked. Much thanks for this post.

  2. Petetech Reply

    May 7, 2012 at 9:54

    Thanks Dude, just had this myself, was all set to hunker down for some research I would rather not do. As you know something you solved last year has a tendency to dribble off the edge of your mind in this work, you saved us heaps of time. Thanks much appreciated.

    • Petetech Reply

      May 7, 2012 at 10:01

      Hi, sorry dude, spoke too soon. Got there and the DWORD value was already 0. There was no SFCDisabled though. Only SFCDisable and SFCQuota with a hexidecimal value of ffffffff give or take an f.

      • drew Reply

        May 8, 2012 at 11:35

        Unfortunately I don’t have a suggestion for a fix, but check out this Microsoft KB article (http://support.microsoft.com/kb/222193) which describes a number of other SFC related registry settings. I’d go through there and compare the values to yours and see if something doesn’t match. Good luck, and I’ll post more if I come across anything that might be helpful.

        • Petetech888 Reply

          May 8, 2012 at 6:05

          Hi Drew, thanks for the quick response. After a few ups and downs and removing over 500+ infections from a computer used for browsing websites that carry them…. a number of root-kits were found. I was fooled into assuming that the issue was registry based. Alas no. What I did discover which may be helpful to someone who cannot access command prompt is to make a shortcut on the desktop, point it to C:\Windows\System32\cmd.exe and run as administrator on Vista and above or when open to elevate to administrator in XP I found this little list which helps with infected systems bypassing a few block.
          Elevate Permission to Stop/Restart Services
          runas /user:_ADMINACCT_ “mmc.exe \”services.msc\””

          Shutdown a PC from the Command Prompt
          runas /user:_ADMINACCT_ “shutdown -s -t 0”

          Restart a PC from the Command Prompt
          runas /user:_ADMINACCT_ “shutdown -r -t 0”

          Elevate Permissions to Edit the Registry
          runas /user:_ADMINACCT_ “regedit.exe”

          Elevate Permissions to run CMD commands
          runas /user:_ADMINACCT_ “cmd.exe”

          Elevate Permissions to Run Network Admin CMD commands
          runas /user:domain\_ADMINACCT_ “cmd.exe”

          Elevate Permissions to Modify Local Policy
          runas /user:_ADMINACCT_ “mmc.exe \”gpmc.msc\””

          Elevate Permissions to View Security Events
          runas /user:_ADMINACCT_ “eventvwr.exe”

          Elevate Permissions to Manage Network Computers
          runas /user:domain\_ADMINACCT_ “mmc.exe \”compmgmt.msc\””

          Hope that’s of some help to someone.

          • Petetech888

            May 8, 2012 at 6:06

            And great link by the way, thanks.

  3. louis armsty Reply

    April 19, 2013 at 10:12

    PErfect ! Thank you !

  4. toofattophuck Reply

    June 29, 2013 at 1:50

    I have an XP computer made in 2000 but it seems to be running slow and crashes all the time. Before it crashes buzzing sounds emanate from the speakers. I tried to run sfc scannow before it crashed without much luck but got the error 0x000006ba rpc is unavailable. Hope this works…

    • drew Reply

      June 29, 2013 at 2:11

      2000? Time to get a new machine. You probably are having hardware failures which are causing the machine to crash, leading to software issues.

      • toofattophuck Reply

        June 29, 2013 at 3:53

        Agreed, but alas I’m stuck this and if I can’t make it work then I’ll be stuck with nothing.

Leave a Reply

Your email address will not be published. Required fields are marked *

*