The RPC Server is Unavailable Error (0x800706BA)

7K

The RPC server is unavailable (Exception from HRESULT: 0x800706BA) error may occur when connecting to a remote computer or server using one of the Remote Management tools.

This post explains how to troubleshoot and fix the RPC communication error 0x800706BA.

Where 0x800706BA error commonly appears:

• Remote WMI queries
• Group Policy updates (gpupdate /force remotely)
• Certificate enrollment
• Remote Event Viewer/Services

Important. Note that RPC is not a single service but a communication mechanism used by multiple Windows components (WMI, DCOM, AD, Certificate Services, etc.). The error “RPC server is unavailable” does not always mean that the RPC service is stopped. In most cases, it indicates one of the following:

• Network connectivity problem
• Your firewall blocking RPC traffic
• RPC endpoint resolution failure (port 135/dynamic ports)
• DCOM access/permission problem

This is why troubleshooting RPC errors always requires checking multiple layers (network, services, firewall, permissions).

Basic RPC Connectivity Troubleshooting on Windows

RPC Troubleshooting Flow

In order to efficiently diagnose RPC error 0x800706BA, you should follow this order:

1. Check connectivity. You should ping remote host and test TCP/135 (RPC Endpoint Mapper).
2. Check RPC endpoint resolution. You should use PortQry to verify RPC endpoints.
3. Check required services (RpcSs, DcomLaunch, RpcEptMapper)
4. Check your firewall rules. You need to ensure TCP/135 and dynamic RPC ports are allowed.
5. Check authentication and permissions (local admin rights/DCOM permissions)
6. Check RPC security policies (Restrict Unauthenticated RPC Clients, RPC endpoint security settings)
7. Check specific service dependencies (WMI/Certificate Services/Group Policy/etc).

This layered approach helps quickly identify the root cause.

Using PowerShell to test WMI connectivity

The easiest way to test the RPC connectivity between the local computer and the remote computer is to query the remote WMI service using PowerShell command:

$CimSessionOption = New-CimSessionOption -Protocol DCOM
$CimSession = New-CimSession -ComputerName wks25h2 -SessionOption $CimSessionOption

Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession

Remove-CimSession $CimSession

The following error indicates that the following remote host cannot be connected via RPC:

The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)

In case you receive an “Access is denied” error instead of 0x800706BA, this means that RPC connectivity is working correctly. In such case, the issue is related to permissions, not network/RPC communication.

Verifying required Windows services

Then ensure that the remote host is powered on and the RPC service is running on it:

1. Check that you have entered the correct IP address or remote computer name;
2. Open the service management snap-in (services.msc). Verify that the Remote Procedure Call (RPC), DCOM Server Process Launcher, and RPC Endpoint Mapper services are running on the remote host. If the services are stopped, run them and configure them to start automatically. Or use PowerShell to check the service status:
   

   Get-Service RpcEptMapper,RpcSs,DcomLaunch

Checking RPC communication ports

The RPC protocol used the following network ports for communication:

• TCP/135 (RPC Endpoint Mapper)
• TCP port from 49152 to 65535 (RPC Dynamic Ports)

These ports must be open and allowed through firewalls between the client and the remote host.

• Check RPC Endpoint Mapper connectivity using PowerShell:
  

  Test-NetConnection 192.168.1.201 -Port 135

If TCP/135 is reachable but RPC operations still fail, you should inspect RPC endpoint registration.

For legacy troubleshooting cases, Microsoft PortQry can still be used:

Keep in mind that PortQry is an older Microsoft diagnostic tool that is still useful for advanced RPC troubleshooting, but it should not be your first-line connectivity test on modern Windows systems. You should start with PowerShell tools (such as Resolve-DnsName and Test-NetConnection), and use PortQry when you need to inspect RPC endpoint registration in more detail.

PortQry.exe -e 135 -n 192.168.1.201

PortQry queries TCP port 135 and displays the RPC endpoints registered with the RPC Endpoint Mapper. The dynamic TCP port assigned to each RPC endpoint is shown in square brackets.

PortQry is available as part of the Windows Server 2003 Resource Kit Tools or can be downloaded from the Microsoft Download Center.

In this example, there are 151 RPC endpoints available. You can check the network availability of a specific RPC service by its port number:

Test-NetConnection 192.168.1.201 -Port 49703

Note. The dynamic RPC port range (49152–65535) is a very common source of problems. Even in case TCP/135 is open, RPC will still fail if dynamic ports are blocked by a firewall. In enterprise environments, we recommend you to:

• Restrict the RPC dynamic port range
• Explicitly allow it in firewalls

Otherwise, RPC failures may occur.

In enterprise environments, you can restrict the RPC dynamic port range. Go to HKLM\Software\Microsoft\Rpc\Internet. Here set values:

• Ports (Multi-String): 50000-51000
• PortsInternetAvailable: Y
• UseInternetPorts: Y

After that, you need to allow this range in your firewall. This significantly simplifies firewall config and reduces attack surface.

Newer Windows versions include RPC security hardening policies that can block RPC communication even when network connectivity and firewall rules are correct.

Check the following Group Policy setting at Computer Configuration > Administrative Templates > System > Remote Procedure Call > Restrict Unauthenticated RPC Clients. Here you need to check if the configured value matches your environment requirements. You should review this policy on both client and server sides.

Check rules in Windows Defender Firewall

Depending on the target service, Windows Defender Firewall should have some rules enabled:

• At least one rule with the description RPC-EPMAP (allows connection to port 135);
• At least one rule with an RPC description (allows access to Dynamic RPC port numbers).

RPC Error 0x800706ba During Certificate Enrollment

The RPC Server Unavailable error often occurs when domain client cannot enroll the certificate from the internal Certificate Authority (CA) running on Windows Server.

An error occurred while enrolling for a certificate.
The certificate request could not be submitted to the certification authority.
The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

The following errors appear in Event Viewer > Application Log:

Source: CertificateServicesClient-CertEnroll

Event ID: 13
Certificate enrollment for the Local system failed to enroll for a DomainController certificate with request ID N/A from ServerCA.contoso.com ServerCA (The RPC server is unavailable. 0x800706ba (WIN32: 1722))

Or:

Source: CertificateServicesClient-AutoEnrollment

EventID: 6
Automatic certificate enrollment for the local system failed (0x800706ba) The RPC server is unavailable.

Fixing DCOM permissions for CA servers

Note that many RPC-based services (including Certificate Services, WMI, and remote management tools) rely on DCOM. Incorrect DCOM config/permissions can result in RPC errors even when network connectivity is working correctly.

The Certificate Service DCOM Access group is a local group on the CA server. You need to check if the appropriate domain groups/computer accounts are members of this group according to your certificate enrollment case.

1. Open the Active Directory Users and Computes console (dsa.msc) > go to Builtin container > open the properties of the ‘Certificate Service DCOM Access‘ group.
2. Check that the following groups are added as members: Domain Users, Domain Controllers, Domain Computers

   

3. Update the DCOM security settings on CA server:
   

   certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG
   net stop certsvc & net start certsvc

Check COM security permissions

In case certificate enrollment still fails, you need to verify the COM security permissions configured on the CA:

1. Run dcomcnfg.exe;
2. Expand Component Services > Computers > My computer > Properties;
3. Go to the Default Properties tab, and check the Enable Distributed COM on this computer option;
   

   

4. Go to COM Security tab and click on the Edit Limits button in the Access Permissions section. Check that the Certificate Service DCOM Access group has Local Access and Remote Access permissions;
   

   

5. Then click the Edit Limits button in the Launch and Activation Permission section and check that the Certificate Service DCOM Access group is allowed for Local Activation and Remote Activation.
6. Restart the computer and check the certificate enrollment.

Check that the CA request interface is responding:

Certutil -ping

Trigger a certificate auto-enrollment check:

certutil -pulse

Enabling required firewall rules for GPO updates

Keep in mind that Remote Group Policy updates rely on RPC communication. In case RPC ports are blocked, GPO update operations will fail with error 0x800706BA.

To resolve this issue, you must enable the following rules in Windows Defender Firewall:

• Remote Scheduled Tasks Management (RPC);
• Remote Scheduled Tasks Management (RPC-EPMAP);
• Windows Management Instrumentation (ASync-In);
• Windows Management Instrumentation (DCOM-In);
• Windows Management Instrumentation (WMI-In);
• Windows Remote Management (HTTP-In).

Enable these rules with a new GPO (Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall > Inbound Rules).

Using Starter GPOs for Group Policy firewall configuration

Or enable the following default Starter GPOs:

• Group Policy Remote Update Firewall Ports;
• Group Policy Reporting Firewall Ports.

Go to the Starter GPOs section, click on each of the items, and select New GPO from Starter GPO. Create new GPOs and assign them to Organizational Units with target computers.

These policies contain all the necessary Windows Defender Firewall rules to remotely update Group Policy settings.

Other fixing tips

If nothing has helped to fix the RPC error, check the following:

• Go to the registry key HKLM\Software\Microsoft\OLE and ensure that the value of the EnableDCOM parameter is set to Y. This means that the DCOM connections are allowed.

  

• Make sure that required firewall rules and network services for the specific RPC-based application are enabled.
  

  

• Try to temporarily disable third-party firewall and anti-virus apps if installed.
• Check that the Private or Domain network profile is being used for your network connection (Public network profile category may prevent some network connections, including RPC):
  

  Get-NetConnectionProfile|select InterfaceAlias,NetworkCategory

Wrapping up

So, you need to troubleshoot 0x800706BA from the network layer upward: first verify DNS and connectivity, then TCP/135 and RPC endpoint resolution, followed by dynamic RPC ports, firewall rules, authentication/authorization, and the application-specific service.

This method helps you to isolate whether the failure occurs before RPC communication is established or at the authentication, authorization, or app layer.