diff --git a/reactos/lib/rpcrt4/ndr_midl.c b/reactos/lib/rpcrt4/ndr_midl.c
index f2929b8937c..f1d6b71c3c2 100644
--- a/reactos/lib/rpcrt4/ndr_midl.c
+++ b/reactos/lib/rpcrt4/ndr_midl.c
@@ -44,7 +44,7 @@
 #include "ndr_misc.h"
 #include "rpcndr.h"
 
-WINE_DEFAULT_DEBUG_CHANNEL(ole);
+WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 /***********************************************************************
  *           NdrProxyInitialize [RPCRT4.@]
diff --git a/reactos/lib/rpcrt4/rpc_binding.c b/reactos/lib/rpcrt4/rpc_binding.c
index 849b8f0f825..326086ad359 100644
--- a/reactos/lib/rpcrt4/rpc_binding.c
+++ b/reactos/lib/rpcrt4/rpc_binding.c
@@ -44,7 +44,7 @@
 #include "rpc_binding.h"
 #include "rpc_message.h"
 
-WINE_DEFAULT_DEBUG_CHANNEL(ole);
+WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 LPSTR RPCRT4_strndupA(LPCSTR src, INT slen)
 {
@@ -462,7 +462,7 @@ RPC_STATUS RPCRT4_OpenBinding(RpcBinding* Binding, RpcConnection** Connection,
     RPCRT4_DestroyConnection(Binding->FromConn);
     Binding->FromConn = NULL;
   } else {
-    /* we already have an connection with acceptable binding, so use it */
+    /* we already have a connection with acceptable binding, so use it */
     if (Binding->FromConn) {
       *Connection = Binding->FromConn;
       return RPC_S_OK;
@@ -1118,9 +1118,38 @@ RPC_STATUS WINAPI RpcNetworkIsProtseqValidW(LPWSTR protseq) {
  * RETURNS
  *  Success: RPS_S_OK.
  *  Failure: RPC_STATUS value.
+ *
+ * NOTES
+ *
+ * If BindingHandle is NULL then the function impersonates the client
+ * connected to the binding handle of the current thread.
  */
 RPC_STATUS WINAPI RpcImpersonateClient(RPC_BINDING_HANDLE BindingHandle)
 {
     FIXME("(%p): stub\n", BindingHandle);
-    return RPC_S_NO_CONTEXT_AVAILABLE;
+    return RPC_S_OK;
+}
+
+/***********************************************************************
+ *             RpcRevertToSelfEx (RPCRT4.@)
+ *
+ * Stops impersonating the client connected to the binding handle so that security
+ * checks are no longer done in the context of the client.
+ *
+ * PARAMS
+ *  BindingHandle [I] Handle to the binding to the client.
+ *
+ * RETURNS
+ *  Success: RPS_S_OK.
+ *  Failure: RPC_STATUS value.
+ *
+ * NOTES
+ *
+ * If BindingHandle is NULL then the function stops impersonating the client
+ * connected to the binding handle of the current thread.
+ */
+RPC_STATUS WINAPI RpcRevertToSelfEx(RPC_BINDING_HANDLE BindingHandle)
+{
+    FIXME("(%p): stub\n", BindingHandle);
+    return RPC_S_OK;
 }
diff --git a/reactos/lib/rpcrt4/rpc_message.c b/reactos/lib/rpcrt4/rpc_message.c
index a57c25c79a4..ebc50171556 100644
--- a/reactos/lib/rpcrt4/rpc_message.c
+++ b/reactos/lib/rpcrt4/rpc_message.c
@@ -42,7 +42,7 @@
 #include "rpc_misc.h"
 #include "rpc_defs.h"
 
-WINE_DEFAULT_DEBUG_CHANNEL(ole);
+WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 DWORD RPCRT4_GetHeaderSize(RpcPktHdr *Header)
 {
diff --git a/reactos/lib/rpcrt4/rpc_server.c b/reactos/lib/rpcrt4/rpc_server.c
index 158033fc7a9..3867ae68694 100644
--- a/reactos/lib/rpcrt4/rpc_server.c
+++ b/reactos/lib/rpcrt4/rpc_server.c
@@ -50,7 +50,7 @@
 
 #define MAX_THREADS 128
 
-WINE_DEFAULT_DEBUG_CHANNEL(ole);
+WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 typedef struct _RpcPacket
 {
@@ -91,8 +91,12 @@ static CRITICAL_SECTION_DEBUG listen_cs_debug =
 };
 static CRITICAL_SECTION listen_cs = { &listen_cs_debug, -1, 0, 0, 0, 0 };
 
+/* whether the server is currently listening */
 static BOOL std_listen;
-static LONG listen_count = -1;
+/* number of manual listeners (calls to RpcServerListen) */
+static LONG manual_listen_count;
+/* total listeners including auto listeners */
+static LONG listen_count;
 /* set on change of configuration (e.g. listening on new protseq) */
 static HANDLE mgr_event;
 /* mutex for ensuring only one thread can change state at a time */
@@ -156,7 +160,7 @@ static RpcServerInterface* RPCRT4_find_interface(UUID* object,
   while (cif) {
     if (!memcmp(if_id, &cif->If->InterfaceId, sizeof(RPC_SYNTAX_IDENTIFIER)) &&
         (check_object == FALSE || UuidEqual(MgrType, &cif->MgrTypeUuid, &status)) &&
-        (std_listen || (cif->Flags & RPC_IF_AUTOLISTEN))) break;
+        std_listen) break;
     cif = cif->Next;
   }
   LeaveCriticalSection(&server_cs);
@@ -583,38 +587,45 @@ static void RPCRT4_sync_with_server_thread(void)
   ReleaseMutex(mgr_mutex);
 }
 
-static void RPCRT4_start_listen(void)
+static void RPCRT4_start_listen(BOOL auto_listen)
 {
   TRACE("\n");
 
   EnterCriticalSection(&listen_cs);
-  if (! ++listen_count) {
-    if (!mgr_mutex) mgr_mutex = CreateMutexW(NULL, FALSE, NULL);
-    if (!mgr_event) mgr_event = CreateEventW(NULL, FALSE, FALSE, NULL);
-    if (!server_ready_event) server_ready_event = CreateEventW(NULL, FALSE, FALSE, NULL);
-    if (!server_sem) server_sem = CreateSemaphoreW(NULL, 0, MAX_THREADS, NULL);
-    if (!worker_tls) worker_tls = TlsAlloc();
-    std_listen = TRUE;
-    server_thread = CreateThread(NULL, 0, RPCRT4_server_thread, NULL, 0, NULL);
-    LeaveCriticalSection(&listen_cs);
-  } else {
-    LeaveCriticalSection(&listen_cs);
-    RPCRT4_sync_with_server_thread();
+  if (auto_listen || (manual_listen_count++ == 0))
+  {
+    if (++listen_count == 1) {
+      /* first listener creates server thread */
+      if (!mgr_mutex) mgr_mutex = CreateMutexW(NULL, FALSE, NULL);
+      if (!mgr_event) mgr_event = CreateEventW(NULL, FALSE, FALSE, NULL);
+      if (!server_ready_event) server_ready_event = CreateEventW(NULL, FALSE, FALSE, NULL);
+      if (!server_sem) server_sem = CreateSemaphoreW(NULL, 0, MAX_THREADS, NULL);
+      if (!worker_tls) worker_tls = TlsAlloc();
+      std_listen = TRUE;
+      server_thread = CreateThread(NULL, 0, RPCRT4_server_thread, NULL, 0, NULL);
+    } else {
+      LeaveCriticalSection(&listen_cs);
+      RPCRT4_sync_with_server_thread();
+      return;
+    }
   }
+  LeaveCriticalSection(&listen_cs);
 }
 
-static void RPCRT4_stop_listen(void)
+static void RPCRT4_stop_listen(BOOL auto_listen)
 {
   EnterCriticalSection(&listen_cs);
-  if (listen_count == -1)
-    LeaveCriticalSection(&listen_cs);
-  else if (--listen_count == -1) {
-    std_listen = FALSE;
-    LeaveCriticalSection(&listen_cs);
-    RPCRT4_sync_with_server_thread();
-  } else
-    LeaveCriticalSection(&listen_cs);
-  assert(listen_count > -2);
+  if (auto_listen || (--manual_listen_count == 0))
+  {
+    if (listen_count != 0 && --listen_count == 0) {
+      std_listen = FALSE;
+      LeaveCriticalSection(&listen_cs);
+      RPCRT4_sync_with_server_thread();
+      return;
+    }
+    assert(listen_count >= 0);
+  }
+  LeaveCriticalSection(&listen_cs);
 }
 
 static RPC_STATUS RPCRT4_use_protseq(RpcServerProtseq* ps)
@@ -847,7 +858,7 @@ RPC_STATUS WINAPI RpcServerRegisterIf2( RPC_IF_HANDLE IfSpec, UUID* MgrTypeUuid,
 
   if (sif->Flags & RPC_IF_AUTOLISTEN) {
     /* well, start listening, I think... */
-    RPCRT4_start_listen();
+    RPCRT4_start_listen(TRUE);
   }
 
   return RPC_S_OK;
@@ -978,7 +989,7 @@ RPC_STATUS WINAPI RpcServerListen( UINT MinimumCallThreads, UINT MaxCalls, UINT
     return RPC_S_ALREADY_LISTENING;
   }
 
-  RPCRT4_start_listen();
+  RPCRT4_start_listen(FALSE);
 
   LeaveCriticalSection(&listen_cs);
 
@@ -1029,11 +1040,7 @@ RPC_STATUS WINAPI RpcMgmtStopServerListening ( RPC_BINDING_HANDLE Binding )
     return RPC_S_WRONG_KIND_OF_BINDING;
   }
   
-  /* hmm... */
-  EnterCriticalSection(&listen_cs);
-  while (std_listen)
-    RPCRT4_stop_listen();
-  LeaveCriticalSection(&listen_cs);
+  RPCRT4_stop_listen(FALSE);
 
   return RPC_S_OK;
 }
diff --git a/reactos/lib/rpcrt4/rpcrt4.spec b/reactos/lib/rpcrt4/rpcrt4.spec
index b098786153e..4ddd84bbe40 100644
--- a/reactos/lib/rpcrt4/rpcrt4.spec
+++ b/reactos/lib/rpcrt4/rpcrt4.spec
@@ -112,7 +112,7 @@
 @ stdcall RpcRaiseException(long)
 @ stub RpcRegisterAsyncInfo
 @ stub RpcRevertToSelf
-@ stub RpcRevertToSelfEx
+@ stdcall RpcRevertToSelfEx(ptr)
 @ stdcall RpcServerInqBindings(ptr)
 @ stub RpcServerInqCallAttributesA # wxp
 @ stub RpcServerInqCallAttributesW # wxp
diff --git a/reactos/lib/rpcrt4/rpcrt4_main.c b/reactos/lib/rpcrt4/rpcrt4_main.c
index 3f7da12d0c6..bdab2e87036 100644
--- a/reactos/lib/rpcrt4/rpcrt4_main.c
+++ b/reactos/lib/rpcrt4/rpcrt4_main.c
@@ -114,7 +114,7 @@
 
 #include "wine/debug.h"
 
-WINE_DEFAULT_DEBUG_CHANNEL(ole);
+WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 static UUID uuid_nil;
 static HANDLE master_mutex;
@@ -328,11 +328,11 @@ static RPC_STATUS RPC_UuidGetNodeAddress(BYTE *address)
     DWORD status = RPC_S_OK;
 
     ULONG buflen = sizeof(IP_ADAPTER_INFO);
-    PIP_ADAPTER_INFO adapter = (PIP_ADAPTER_INFO)HeapAlloc(GetProcessHeap(), 0, buflen);
+    PIP_ADAPTER_INFO adapter = HeapAlloc(GetProcessHeap(), 0, buflen);
 
     if (GetAdaptersInfo(adapter, &buflen) == ERROR_BUFFER_OVERFLOW) {
         HeapFree(GetProcessHeap(), 0, adapter);
-        adapter = (IP_ADAPTER_INFO *)HeapAlloc(GetProcessHeap(), 0, buflen);
+        adapter = HeapAlloc(GetProcessHeap(), 0, buflen);
     }
 
     if (GetAdaptersInfo(adapter, &buflen) == NO_ERROR) {
@@ -347,7 +347,7 @@ static RPC_STATUS RPC_UuidGetNodeAddress(BYTE *address)
             address[i] = rand() & 0xff;
         }
 
-        address[0] |= 0x80;
+        address[0] |= 0x01;
         status = RPC_S_UUID_LOCAL_ONLY;
     }