I know that 0xC0030003 error is maddening — it pops up mid-deployment and looks like an RPC failure when it's really a corrupted or truncated character translation table file. Let's fix it.
The Fix
The offending file lives alongside rpcss.dll and is named something like xlt.dll, nl, or a locale-specific xlat table. When it drops below 512 bytes — usually from a botched update, disk corruption, or antivirus quarantine — the RPC runtime refuses to load it and throws 0xC0030003.
Step 1: Find the truncated file
Open an elevated Command Prompt and scan the RPC directories:
dir /s /a C:\Windows\System32\*.xlt
forfiles /P C:\Windows\System32 /M *xlt* /C "cmd /c if @fsize LSS 512 echo @path @fsize"Also check C:\Windows\SysWOW64 if you run 32-bit RPC clients on a 64-bit OS. Any file under 512 bytes is your culprit.
Step 2: Replace it from a known-good machine
Grab the same-named file from a healthy server with the identical Windows build. Copy it over, then fix ownership:
takeown /f C:\Windows\System32\xlt.dll /a
takeown /f C:\Windows\SysWOW64\xlt.dll /a
icacls C:\Windows\System32\xlt.dll /reset
icacls C:\Windows\SysWOW64\xlt.dll /resetIf you can't find a matching machine, run sfc /scannow first, then DISM /Online /Cleanup-Image /RestoreHealth. SFC pulls the correct file from the component store — it's the cleanest option when it works.
Step 3: Restart the RPC services
Don't reboot the whole box if you can avoid it. Stop the dependent services and restart RPC:
net stop rpcss /y
net start rpcss
net start rpcssThen restart anything that depends on RPC: DcomLaunch, RpcEptMapper, and your app service. A full reboot is the safe move if you're not sure what's hooked in.
Why This Worked
The RPC runtime loads character translation tables at service startup to convert between ANSI and Unicode for legacy RPC calls. Microsoft's spec defines the minimum table size as 512 bytes — that's the header plus the base character set. When a file is truncated to 200 bytes, the parser reads past the end of the buffer, fails validation, and returns RPC_NT_SS_CHAR_TRANS_SHORT_FILE. Restoring a full-sized file clears the check.
Real-world trigger: I've seen this twice this year — once after a CrowdStrike Falcon update quarantined a file that matched a heuristic, and once after a half-finished Windows cumulative update left the System32 xlt file at 0 bytes. Both times, RPC looked broken until we replaced the file.
Less Common Variations
Antivirus keeps re-quarantining it
Add an exclusion for C:\Windows\System32\*xlt* and C:\Windows\SysWOW64\*xlt*. Then restore the file from the quarantine vault rather than re-copying — the AV engine hashes the file and will re-quarantine on next scan otherwise.
Third-party app shipped its own translation table
Some legacy ERP and MES apps (older SAP GUI builds, certain Wonderware versions) drop their own xlat file in %ProgramFiles% or C:\Windows\System32. If the app's installer truncated the file, re-run the installer with the "Repair" option. Don't just copy over it — you'll break the app's encoding.
File is fine but corruption is in the registry
Check the RPC config keys under HKLM\SOFTWARE\Microsoft\RPC — specifically any CharTransTable value pointing to a custom path. If the path is stale, RPC falls back to a zero-byte placeholder. Delete the value and let RPC use the default.
Cluster or failover node mismatch
On a Windows Failover Cluster, if one node has a different patch level, its translation table can be a different size. RPC calls that bounce between nodes fail intermittently with 0xC0030003. Patch all nodes to the same CU level.
Prevention
- Exclude RPC-related DLLs from AV real-time scanning on servers running heavy RPC workloads.
- Always finish Windows Updates — never cancel mid-install. Half-applied CUs are the #1 cause I've seen.
- Monitor RPC service health with a simple check: query
sc query rpcssand alert if state isn't RUNNING. - Before deploying a third-party app, snapshot the server. If it drops its own xlat file, you can roll back in seconds.
- Keep a copy of the known-good xlt files from your base image. It turns a 40-minute outage into a 2-minute fix.