[Samba] smbd process hanging due to rpcd services

Fri Jan 30 14:03:09 UTC 2026

Hi folks,

Since almost a year, the smbd process hangs irregularly when users 
create PDF files from Adobe InDesign, or SolidWorks. The users are all 
using Windows 11 25H2. I have nailed the problem down to the some of the 
rpcd services starting and getting stuck. I have disabled svcctl in 
smb.conf, but smbd does not seem to honor that. The problems started 
last year after upgrade to Samba 4.21.5 (the machine on Debian 12 at 
that time), and have continued intermittently since that time.

OS: Debian 13, Samba 4.23.5 from Trixie backports, the server is domain 
joined

smb.conf
========

[global]
# Prior to version 4.23.0+dfsg-4, debian samba package carried 
usershare.patch
# patch which changed default value for "usershare max share" parameter
     usershare max shares = 100
         client signing = required
         debug uid = Yes
         dedicated keytab file = /etc/krb5.keytab
         disable netbios = Yes
         disable spoolss = Yes
         kerberos method = secrets and keytab
         log level = 1
         panic action = /usr/share/samba/panic-action %d
         printcap name = /dev/null
         realm = MYDOM.TALPS
         restrict anonymous = 2
         security = ADS
         server role = member server
         smb ports = 445
         template homedir = /home/%U
         template shell = /sbin/nologin
         winbind use default domain = yes
         timestamp logs = Yes
         username map = /etc/samba/user.map
         min domain uid = 0
         winbind refresh tickets = Yes
         workgroup = MYDOM
         idmap config mydom : range = 10000-99999
         idmap config mydom : backend = rid
         idmap config * : range = 3000-9999
         idmap config * : backend = tdb
         map acl inherit = Yes
         vfs objects = acl_xattr

         hide unreadable = yes
         veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/

         dcerpc endpoint servers = epmapper, wkssvc, samr, netlogon, 
lsarpc, srvsvc, winreg
         rpc_server:svcctl = disabled
         rpc_server:ntsvcs = disabled
         rpc_daemon:spoolss = disabled
         rpc_daemon:svcctl = disabled
         load printers = no
         printing = bsd
         show add printer wizard = no
         strict locking = no

         # Later Reduce winbind query load with caching
         winbind cache time = 300
         idmap cache time = 604800

[Homes$]
         readonly = no
         path = /data/samba/homes
         csc policy = disable

[Profiles$]
         readonly = no
         path = /data/samba/profiles
         csc policy = disable

[Users$]
         readonly = no
         path = /data/samba/users
         csc policy = disable

[Share1]
         readonly = no
         path = /data/samba/Share1

[Share2]
         readonly = no
         path = /data/samba/Share2

[Share3]
         readonly = no
         path = /data/samba/Share3

smbd log excerpt from journalctl -xeu smbd
==========================================

Jan 30 13:19:31 datasrv rpcd_classic[6959]: [2026/01/30 
13:19:31.586065,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:31 datasrv rpcd_classic[6958]: [2026/01/30 
13:19:31.585505,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:31 datasrv rpcd_classic[6959]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:31 datasrv rpcd_classic[6958]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:31 datasrv rpcd_classic[6959]: [2026/01/30 
13:19:31.587116,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6959]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6958]: [2026/01/30 
13:19:31.587389,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6959]: [2026/01/30 
13:19:31.588137,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6958]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6959]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6959]: [2026/01/30 
13:19:31.589363,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:31 datasrv rpcd_classic[6959]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6958]: [2026/01/30 
13:19:31.589350,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6958]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6958]: [2026/01/30 
13:19:31.591395,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:31 datasrv rpcd_classic[6960]: [2026/01/30 
13:19:31.587062,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:31 datasrv rpcd_classic[6958]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6960]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:31 datasrv rpcd_classic[6960]: [2026/01/30 
13:19:31.593088,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6960]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6960]: [2026/01/30 
13:19:31.595411,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:31 datasrv rpcd_classic[6960]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:31 datasrv rpcd_classic[6960]: [2026/01/30 
13:19:31.596877,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:31 datasrv rpcd_classic[6960]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6983]: [2026/01/30 
13:19:57.176009,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:57 datasrv rpcd_classic[6983]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:57 datasrv rpcd_classic[6985]: [2026/01/30 
13:19:57.174948,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:57 datasrv rpcd_classic[6985]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:57 datasrv rpcd_classic[6984]: [2026/01/30 
13:19:57.176670,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg)
Jan 30 13:19:57 datasrv rpcd_classic[6984]:   svcctl_init_winreg: Could 
not open SYSTEM\CurrentControlSet\Services - 
NT_STATUS_CONNECTION_DISCONNECTED
Jan 30 13:19:57 datasrv rpcd_classic[6983]: [2026/01/30 
13:19:57.177025,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6983]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6984]: [2026/01/30 
13:19:57.177784,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6984]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6985]: [2026/01/30 
13:19:57.177330,  0, effective(0, 0), real(0, 0)] 
librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6983]: [2026/01/30 
13:19:57.178046,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6983]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6985]:  dcesrv_init_ep_server: 
Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6984]: [2026/01/30 
13:19:57.178804,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6984]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6983]: [2026/01/30 
13:19:57.179122,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:57 datasrv rpcd_classic[6983]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6985]: [2026/01/30 
13:19:57.179219,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:954(register_ep_server)
Jan 30 13:19:57 datasrv rpcd_classic[6984]: [2026/01/30 
13:19:57.179826,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:57 datasrv rpcd_classic[6985]:   register_ep_server: 
dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6984]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL
Jan 30 13:19:57 datasrv rpcd_classic[6985]: [2026/01/30 
13:19:57.180784,  0, effective(0, 0), real(0, 0)] 
source3/rpc_server/rpc_worker.c:1227(rpc_worker_main)
Jan 30 13:19:57 datasrv rpcd_classic[6985]:   rpc_worker_main: 
register_ep_server failed: NT_STATUS_UNSUCCESSFUL

I'm not able to solve this myself with the knowledge I have. I suspect 
that it's a bug in samba, as the rpcserver entries do not seem to be 
honored.

I would be very grateful, if somebody with knowledge could point me in 
the right direction

Best regards,

Peter