Here is a little tool to dump the contents of the endpoint mapper;
real ugly output, but it gives some ideas about what's running and
waiting on what dynamincally assigned ports:

usage:

"epdump"  gives you the local machine's bindings

"epdump foo" gives you \\foo's bindings, connecting to it over TCP

"epdump ncacn_spx foo" gives you \\foo's bindings, connecting over SPX.

It just calls RpcMgmtEpEltInqBegin and iterates through the EP
entries, printing them out.

Paul