Created attachment 15463 [details] Image of connection issue Bug related to changes in bug 11428 [1] - "dcerpc binding string options are nowhere documented". The binding strings as documented in the man page for rpcclient do not work. Namely, I have been attempting to use "ncacn_ip_tcp:x.x.x.x[135]" to connect directly to the MS-RPC service using DCERPC. Instead, rpcclient attempts to connect on port 445 and then on port 139 using SMB. I.e., it behaves if the binding string specified was "ncacn_np:x.x.x.x". Please see attached image of a Wireshark capture next to the command execution. I have taken preliminary look over the code of rpcclient.c [2] and it does appear that both the transport and port from when the binding string is parsed are not passed into cli_full_connection function call. Instead the port can be specified using the command line option '-p'. Probably the easiest course of action is to clarify in the man page that the transport ncacn_ip_tcp is not supported. [1]. https://bugzilla.samba.org/show_bug.cgi?id=11428 [2]. https://github.com/samba-team/samba/blob/v4-11-stable/source3/rpcclient/rpcclient.c