Event ID 13 from Microsoft-Windows-CertificateServicesClient-CertEnroll reports that a
certificate enrolment attempt failed, most famously with "The RPC server is unavailable"
(0x800706BA). The client located the CA in Active Directory but could not complete the
DCOM/RPC call to submit the request. On NDES servers this blocks the RA certificates; on
domain members it breaks autoenrolment.
Event ID 13
CertEnroll Event 13: enrolment failed, RPC server unavailable
What it means
Common causes
Active Directory Certificate Services (CertSvc) is stopped on the CA.
Firewall between client and CA blocks RPC — TCP 135 plus the dynamic RPC port range.
The computer or user lacks DCOM access to the CA: the CA's Security tab must grant Request Certificates, and the built-in Certificate Service DCOM Access group must contain the expected principals.
Stale CA objects in AD (a decommissioned CA still published) sending clients to a server that no longer exists — very common mid-migration.
How to fix it
From the failing machine, run
certutil -ping <CAHostName>\<CAName>— this reproduces the DCOM call and confirms or clears the transport path.On the CA, ensure the Active Directory Certificate Services service is running, and check the CA's Security tab grants Request Certificates to the relevant computers/users.
Open firewall paths for RPC (TCP 135 + dynamic range 49152-65535 by default) between the enrolment client and the CA.
During decommissioning, clean up old enrollment services objects with
certutil -viewdelstorealternatives — practically: remove the retired CA from AD via the AD CS uninstall orcertutil -dspublishcleanup guidance, so clients stop targeting it.