diff --git a/reactos/dll/win32/rpcrt4/rpc_binding.h b/reactos/dll/win32/rpcrt4/rpc_binding.h
index ed8d4ea062d..e169a650e6e 100644
--- a/reactos/dll/win32/rpcrt4/rpc_binding.h
+++ b/reactos/dll/win32/rpcrt4/rpc_binding.h
@@ -41,6 +41,7 @@ typedef struct _RpcAuthInfo
   /* our copy of NT auth identity structure, if the authentication service
    * takes an NT auth identity */
   SEC_WINNT_AUTH_IDENTITY_W *nt_identity;
+  LPWSTR server_principal_name;
 } RpcAuthInfo;
 
 typedef struct _RpcQualityOfService
@@ -73,6 +74,7 @@ typedef struct _RpcConnection
   /* client-only */
   struct list conn_pool_entry;
   ULONG assoc_group_id; /* association group returned during binding */
+  RPC_ASYNC_STATE *async_state;
 
   /* server-only */
   /* The active interface bound to server. */
@@ -92,6 +94,7 @@ struct connection_ops {
   int (*write)(RpcConnection *conn, const void *buffer, unsigned int len);
   int (*close)(RpcConnection *conn);
   void (*cancel_call)(RpcConnection *conn);
+  int (*wait_for_incoming_data)(RpcConnection *conn);
   size_t (*get_top_of_tower)(unsigned char *tower_data, const char *networkaddr, const char *endpoint);
   RPC_STATUS (*parse_top_of_tower)(const unsigned char *tower_data, size_t tower_size, char **networkaddr, char **endpoint);
 };
diff --git a/reactos/dll/win32/rpcrt4/rpc_server.c b/reactos/dll/win32/rpcrt4/rpc_server.c
index 12e64e23367..953cccfa94d 100644
--- a/reactos/dll/win32/rpcrt4/rpc_server.c
+++ b/reactos/dll/win32/rpcrt4/rpc_server.c
@@ -391,6 +391,7 @@ static DWORD CALLBACK RPCRT4_io_thread(LPVOID the_arg)
 
     packet = HeapAlloc(GetProcessHeap(), 0, sizeof(RpcPacket));
     if (!packet) {
+      I_RpcFree(msg->Buffer);
       HeapFree(GetProcessHeap(), 0, msg);
       break;
     }
@@ -399,6 +400,7 @@ static DWORD CALLBACK RPCRT4_io_thread(LPVOID the_arg)
     packet->msg = msg;
     if (!QueueUserWorkItem(RPCRT4_worker_thread, packet, WT_EXECUTELONGFUNCTION)) {
       ERR("couldn't queue work item for worker thread, error was %d\n", GetLastError());
+      I_RpcFree(msg->Buffer);
       HeapFree(GetProcessHeap(), 0, msg);
       HeapFree(GetProcessHeap(), 0, packet);
       break;
diff --git a/reactos/dll/win32/rpcrt4/rpc_transport.c b/reactos/dll/win32/rpcrt4/rpc_transport.c
index 020c36b5897..b66ccc5616b 100644
--- a/reactos/dll/win32/rpcrt4/rpc_transport.c
+++ b/reactos/dll/win32/rpcrt4/rpc_transport.c
@@ -434,6 +434,12 @@ static void rpcrt4_conn_np_cancel_call(RpcConnection *Connection)
     /* FIXME: implement when named pipe writes use overlapped I/O */
 }
 
+static int rpcrt4_conn_np_wait_for_incoming_data(RpcConnection *Connection)
+{
+    /* FIXME: implement when named pipe writes use overlapped I/O */
+    return -1;
+}
+
 static size_t rpcrt4_ncacn_np_get_top_of_tower(unsigned char *tower_data,
                                                const char *networkaddr,
                                                const char *endpoint)
@@ -1076,6 +1082,32 @@ static void rpcrt4_conn_tcp_cancel_call(RpcConnection *Connection)
     write(tcpc->cancel_fds[1], &dummy, 1);
 }
 
+static int rpcrt4_conn_tcp_wait_for_incoming_data(RpcConnection *Connection)
+{
+    RpcConnection_tcp *tcpc = (RpcConnection_tcp *) Connection;
+    struct pollfd pfds[2];
+
+    TRACE("%p\n", Connection);
+
+    pfds[0].fd = tcpc->sock;
+    pfds[0].events = POLLIN;
+    pfds[1].fd = tcpc->cancel_fds[0];
+    pfds[1].events = POLLIN;
+    if (poll(pfds, 2, -1 /* infinite */) == -1 && errno != EINTR)
+    {
+      ERR("poll() failed: %s\n", strerror(errno));
+      return -1;
+    }
+    if (pfds[1].revents & POLLIN) /* canceled */
+    {
+      char dummy;
+      read(pfds[1].fd, &dummy, sizeof(dummy));
+      return -1;
+    }
+
+    return 0;
+}
+
 static size_t rpcrt4_ncacn_ip_tcp_get_top_of_tower(unsigned char *tower_data,
                                                    const char *networkaddr,
                                                    const char *endpoint)
@@ -1361,6 +1393,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_np_write,
     rpcrt4_conn_np_close,
     rpcrt4_conn_np_cancel_call,
+    rpcrt4_conn_np_wait_for_incoming_data,
     rpcrt4_ncacn_np_get_top_of_tower,
     rpcrt4_ncacn_np_parse_top_of_tower,
   },
@@ -1373,6 +1406,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_np_write,
     rpcrt4_conn_np_close,
     rpcrt4_conn_np_cancel_call,
+    rpcrt4_conn_np_wait_for_incoming_data,
     rpcrt4_ncalrpc_get_top_of_tower,
     rpcrt4_ncalrpc_parse_top_of_tower,
   },
@@ -1385,6 +1419,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_tcp_write,
     rpcrt4_conn_tcp_close,
     rpcrt4_conn_tcp_cancel_call,
+    rpcrt4_conn_tcp_wait_for_incoming_data,
     rpcrt4_ncacn_ip_tcp_get_top_of_tower,
     rpcrt4_ncacn_ip_tcp_parse_top_of_tower,
   }
@@ -1501,6 +1536,7 @@ RPC_STATUS RPCRT4_CreateConnection(RpcConnection** Connection, BOOL server,
   NewConnection->QOS = QOS;
 
   list_init(&NewConnection->conn_pool_entry);
+  NewConnection->async_state = NULL;
 
   TRACE("connection: %p\n", NewConnection);
   *Connection = NewConnection;
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4.rbuild b/reactos/dll/win32/rpcrt4/rpcrt4.rbuild
index ae3c73365ff..792f471df9c 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4.rbuild
+++ b/reactos/dll/win32/rpcrt4/rpcrt4.rbuild
@@ -16,6 +16,7 @@
 	<library>uuid</library>
 	<library>ntdll</library>
 	<library>kernel32</library>
+	<library>user32</library>
 	<library>advapi32</library>
 	<library>secur32</library>
 	<library>iphlpapi</library>
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4.spec b/reactos/dll/win32/rpcrt4/rpcrt4.spec
index 3dc9edc4d63..a235302ecb5 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4.spec
+++ b/reactos/dll/win32/rpcrt4/rpcrt4.spec
@@ -21,7 +21,6 @@
 @ stdcall I_RpcAbortAsyncCall(ptr long) I_RpcAsyncAbortCall
 @ stdcall I_RpcAllocate(long)
 @ stdcall I_RpcAsyncAbortCall(ptr long)
-@ stub I_RpcAsyncSendReceive # NT4
 @ stdcall I_RpcAsyncSetHandle(ptr ptr)
 @ stub I_RpcBCacheAllocate
 @ stub I_RpcBCacheFree
@@ -39,7 +38,6 @@
 @ stdcall I_RpcBindingSetAsync(ptr ptr)
 @ stub I_RpcBindingToStaticStringBindingW
 @ stub I_RpcClearMutex
-@ stub I_RpcConnectionInqSockBuffSize2
 @ stub I_RpcConnectionInqSockBuffSize
 @ stub I_RpcConnectionSetSockBuffSize
 @ stub I_RpcDeleteMutex
@@ -48,19 +46,13 @@
 @ stdcall I_RpcFree(ptr)
 @ stdcall I_RpcFreeBuffer(ptr)
 @ stub I_RpcFreePipeBuffer
-@ stub I_RpcGetAssociationContext
 @ stdcall I_RpcGetBuffer(ptr)
 @ stub I_RpcGetBufferWithObject
 @ stdcall I_RpcGetCurrentCallHandle()
 @ stub I_RpcGetExtendedError
-@ stub I_RpcGetServerContextList
-@ stub I_RpcGetThreadEvent # win9x
-@ stub I_RpcGetThreadWindowHandle # win9x
 @ stub I_RpcIfInqTransferSyntaxes
-@ stub I_RpcLaunchDatagramReceiveThread # win9x
 @ stub I_RpcLogEvent
 @ stdcall I_RpcMapWin32Status(long)
-@ stub I_RpcMonitorAssociation
 @ stub I_RpcNegotiateTransferSyntax # wxp
 @ stub I_RpcNsBindingSetEntryName
 @ stub I_RpcNsBindingSetEntryNameA
@@ -83,46 +75,24 @@
 @ stub I_RpcServerSetAddressChangeFn
 @ stdcall I_RpcServerStartListening(ptr) # win9x
 @ stdcall I_RpcServerStopListening() # win9x
-@ stub I_RpcServerUnregisterEndpointA # win9x
-@ stub I_RpcServerUnregisterEndpointW # win9x
 @ stub I_RpcServerUseProtseq2A
 @ stub I_RpcServerUseProtseq2W
 @ stub I_RpcServerUseProtseqEp2A
 @ stub I_RpcServerUseProtseqEp2W
-@ stub I_RpcSetAssociationContext # win9x
 @ stub I_RpcSetAsyncHandle
-@ stub I_RpcSetServerContextList
-@ stub I_RpcSetThreadParams # win9x
-@ stub I_RpcSetWMsgEndpoint # NT4
 @ stub I_RpcSsDontSerializeContext
-@ stub I_RpcStopMonitorAssociation
 @ stub I_RpcSystemFunction001 # wxp (oh, brother!)
-@ stub I_RpcTransCancelMigration # win9x
-@ stub I_RpcTransClientMaxFrag # win9x
-@ stub I_RpcTransClientReallocBuffer # win9x
 @ stub I_RpcTransConnectionAllocatePacket
 @ stub I_RpcTransConnectionFreePacket
 @ stub I_RpcTransConnectionReallocPacket
 @ stub I_RpcTransDatagramAllocate2
 @ stub I_RpcTransDatagramAllocate
 @ stub I_RpcTransDatagramFree
-@ stub I_RpcTransGetAddressList
 @ stub I_RpcTransGetThreadEvent
 @ stub I_RpcTransIoCancelled
-@ stub I_RpcTransMaybeMakeReceiveAny # win9x
-@ stub I_RpcTransMaybeMakeReceiveDirect # win9x
-@ stub I_RpcTransPingServer # win9x
-@ stub I_RpcTransServerFindConnection # win9x
-@ stub I_RpcTransServerFreeBuffer # win9x
-@ stub I_RpcTransServerMaxFrag # win9x
 @ stub I_RpcTransServerNewConnection
-@ stub I_RpcTransServerProtectThread # win9x
-@ stub I_RpcTransServerReallocBuffer # win9x
-@ stub I_RpcTransServerReceiveDirectReady # win9x
-@ stub I_RpcTransServerUnprotectThread # win9x
 @ stub I_RpcTurnOnEEInfoPropagation # wxp
 @ stdcall I_RpcWindowProc(ptr long long long) # win9x
-@ stub I_RpcltDebugSetPDUFilter
 @ stub I_UuidCreate
 @ stub MIDL_wchar_strcpy
 @ stub MIDL_wchar_strlen
@@ -135,8 +105,6 @@
 @ stub MesHandleFree
 @ stub MesIncrementalHandleReset
 @ stub MesInqProcEncodingId
-@ stub MqGetContext # win9x
-@ stub MqRegisterQueue # win9x
 @ stdcall NDRCContextBinding(ptr)
 @ stdcall NDRCContextMarshall(ptr ptr)
 @ stdcall NDRCContextUnmarshall(ptr ptr ptr long)
@@ -361,7 +329,6 @@
 @ stub NdrpReleaseTypeGenCookie # wxp
 @ stub NdrpSetRpcSsDefaults
 @ stub NdrpVarVtOfTypeDesc # wxp
-@ stub PerformRpcInitialization
 @ stdcall RpcAbortAsyncCall(ptr long) RpcAsyncAbortCall
 @ stdcall RpcAsyncAbortCall(ptr long)
 @ stdcall RpcAsyncCancelCall(ptr long)
@@ -421,8 +388,6 @@
 @ stub RpcIfInqId
 @ stdcall RpcImpersonateClient(ptr)
 @ stdcall RpcInitializeAsyncHandle(ptr long) RpcAsyncInitializeHandle
-@ stub RpcMgmtBindingInqParameter # win9x
-@ stub RpcMgmtBindingSetParameter # win9x
 @ stdcall RpcMgmtEnableIdleCleanup()
 @ stdcall RpcMgmtEpEltInqBegin(ptr long ptr long ptr ptr)
 @ stub RpcMgmtEpEltInqDone
@@ -432,7 +397,6 @@
 @ stub RpcMgmtInqComTimeout
 @ stub RpcMgmtInqDefaultProtectLevel
 @ stdcall RpcMgmtInqIfIds(ptr ptr)
-@ stub RpcMgmtInqParameter # win9x
 @ stub RpcMgmtInqServerPrincNameA
 @ stub RpcMgmtInqServerPrincNameW
 @ stub RpcMgmtInqStats
@@ -440,7 +404,6 @@
 @ stub RpcMgmtSetAuthorizationFn
 @ stdcall RpcMgmtSetCancelTimeout(long)
 @ stdcall RpcMgmtSetComTimeout(ptr long)
-@ stub RpcMgmtSetParameter # win9x
 @ stdcall RpcMgmtSetServerStackSize(long)
 @ stub RpcMgmtStatsVectorFree
 @ stdcall RpcMgmtStopServerListening(ptr)
@@ -526,7 +489,6 @@
 @ stub SimpleTypeAlignment # wxp
 @ stub SimpleTypeBufferSize # wxp
 @ stub SimpleTypeMemorySize # wxp
-@ stub StartServiceIfNecessary # win9x
 @ stdcall TowerConstruct(ptr ptr ptr ptr ptr ptr)
 @ stdcall TowerExplode(ptr ptr ptr ptr ptr ptr)
 @ stdcall UuidCompare(ptr ptr ptr)