Windows "The RPC server is unavailable" (0x800706BA): how to find what blocks it
Fix "The RPC server is unavailable" (0x800706BA, error 1722): check the name, port 135, the dynamic ports, the firewall rules and the RPC services, step by step.
by OhSudo ··
Get-WmiObject : The RPC server is unavailable.Many programs add the code: The RPC server is unavailable. (Exception from HRESULT: 0x800706BA). The same failure has other faces too: error 1722, dcdiag or repadmin reporting replication errors, a domain join that fails, or a management console that can’t connect.
Don’t be misled by the wording: it rarely means RPC is broken. It nearly always means your computer couldn’t reach the other one on the ports RPC uses. And those are two sets of ports, which is why the usual quick test can pass while the error stays.
How RPC connects
- The client connects to TCP 135, the endpoint mapper, and asks which port the service is on.
- The answer is a dynamic port, by default in 49152–65535.
- The client connects to that port.
A firewall that allows 135 but not the dynamic range gives exactly this error.
- Clientasks the endpoint mapperTCP 135
- TCP 135answers: use port 49xxx(works)then connects to(fails)
- Dynamic port49152–65535, blocked(breaks here)
TL;DR
Resolve-DnsName server01 # the right address?Test-NetConnection server01 -Port 135 # the endpoint mapperGet-Service RpcSs, RpcEptMapper, DcomLaunch, Winmgmt # on the targetEnable-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)" # on the target1. Are you talking to the right machine?
A stale DNS record sends you to a machine that isn’t there, or isn’t the one you meant:
Resolve-DnsName server01ping server01On the target, compare with ipconfig. Also try the IP address instead of the name: if that works and the name doesn’t, it’s DNS. Run ipconfig /flushdns on the client and fix the record. In a domain, ipconfig /registerdns on the target usually does it.
2. Test port 135
Test-NetConnection server01 -Port 135TcpTestSucceeded : True means the first step works. False means the machine is off, or a firewall on the way blocks it, or the service is down (section 4).
Our Port Lookup has an entry for 135, and why it should never be open to the internet.
3. Test the dynamic ports
Find which port the service got. portqry, a free Microsoft tool, asks the endpoint mapper directly:
portqry -n server01 -e 135It lists the services with their ports, for example ncacn_ip_tcp:server01[49668]. Test one of them:
Test-NetConnection server01 -Port 49668If 135 passes and this fails, you’ve found it: a firewall between the machines blocks the dynamic range. Open 49152–65535 from the management machines, on any network firewall in the path, in a cloud security group, and on the target’s firewall.
The range can differ. To see it on the target:
netsh int ipv4 show dynamicport tcp4. Check the services on the target
Run these on the target, or through the console if you can’t reach it:
Get-Service RpcSs, RpcEptMapper, DcomLaunch, Winmgmt | Format-Table Name, Status, StartTypeThe first three must be Running, and they’re not something you stop by accident. If they aren’t, the machine has a bigger problem, so check the System event log. Winmgmt is the WMI service:
Start-Service Winmgmt5. Check the Windows Firewall on the target
Windows ships with rule groups for this, turned off on many networks:
Enable-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)"Enable-NetFirewallRule -DisplayGroup "Remote Service Management"Enable-NetFirewallRule -DisplayGroup "Remote Event Log Management"Enable only what you use. To see which network profile applies, since a rule might only cover Domain while the machine thinks it’s on Public:
Get-NetConnectionProfileA domain-joined machine showing Public usually couldn’t reach a domain controller when its network came up.
6. On domain controllers
For replication errors, run on the domain controller:
dcdiag /test:connectivity /test:replicationsrepadmin /showreplrepadmin /replsummaryDomain controllers also need DNS working between them, Kerberos (TCP/UDP 88), LDAP (389) and SMB (445), besides RPC. A wide clock difference breaks Kerberos, so check w32tm /query /status as well. If a machine has lost its place in the domain instead, see the trust relationship failed.
7. Skip DCOM: use WinRM
Get-WmiObject uses DCOM, and needs those dynamic ports. Get-CimInstance uses WinRM, one fixed port (TCP 5985, or 5986 with TLS), which is far easier on firewalls:
Test-NetConnection server01 -Port 5985Get-CimInstance Win32_OperatingSystem -ComputerName server01Get-WmiObject doesn’t even exist in PowerShell 7, so it’s worth moving anyway. WinRM is on by default on Windows Server. On a client, run Enable-PSRemoting once.
Warning
Don’t turn off the whole firewall to “fix” this, and don’t expose 135 or the dynamic range outside your internal network. Open them only from the machines that manage this one.
Shell, we have a problem!
Similar, but different: Access is denied (0x80070005) means you got through and lack the rights, so the network is fine. The specified domain either does not exist or could not be contacted is DNS. The RPC server is too busy (0x800706BB) means the service answered, and is overloaded. And to tell a blocked port from a closed one in general, see “Connection timed out” vs “Connection refused”.
Found this useful? Share it.
Found a mistake? Let us know at contact@ohsudo.com.