0x800706BA wraps Win32 error 1722, RPC_S_SERVER_UNAVAILABLE. In PKI contexts it means the
client (a domain member, an NDES server, or a management console) attempted an RPC/DCOM
connection to the certification authority and could not establish it. It is a transport
failure — the request never reached the CA's application logic.
0x800706BA
The RPC server is unavailable
What it means
Common causes
Active Directory Certificate Services (CertSvc) stopped on the CA server.
Firewalls blocking TCP 135 (RPC endpoint mapper) and/or the dynamic RPC port range between client and CA.
DNS pointing at the wrong host, or the CA host renamed/retired while its AD enrollment objects remain.
The CA server is up but overloaded or mid-reboot during patching windows.
How to fix it
Reproduce cheaply from the failing host:
certutil -ping <CAHostName>\<CACommonName>— success rules out transport and points you at permissions instead.On the CA:
Get-Service certsvcmust be Running; start it and check the Application log if it will not stay up.Verify firewall rules allow TCP 135 plus the dynamic RPC range (default 49152-65535) from clients/NDES to the CA.
Check DNS:
nslookupthe CA host from the client and confirm it resolves to the current server, not a stale record.