Event ID 13

CertEnroll Event 13: enrolment failed, RPC server unavailable

Last reviewed 2026-07-18 by the Just Software engineering team · also seen as certificateservicesclient-certenroll 13, autoenrollment event 13

What it means

Event ID 13 from Microsoft-Windows-CertificateServicesClient-CertEnroll reports that a certificate enrolment attempt failed, most famously with "The RPC server is unavailable" (0x800706BA). The client located the CA in Active Directory but could not complete the DCOM/RPC call to submit the request. On NDES servers this blocks the RA certificates; on domain members it breaks autoenrolment.

Common causes

  1. Active Directory Certificate Services (CertSvc) is stopped on the CA.

  2. Firewall between client and CA blocks RPC — TCP 135 plus the dynamic RPC port range.

  3. The computer or user lacks DCOM access to the CA: the CA's Security tab must grant Request Certificates, and the built-in Certificate Service DCOM Access group must contain the expected principals.

  4. Stale CA objects in AD (a decommissioned CA still published) sending clients to a server that no longer exists — very common mid-migration.

How to fix it

  1. From the failing machine, run certutil -ping <CAHostName>\<CAName> — this reproduces the DCOM call and confirms or clears the transport path.

  2. On the CA, ensure the Active Directory Certificate Services service is running, and check the CA's Security tab grants Request Certificates to the relevant computers/users.

  3. Open firewall paths for RPC (TCP 135 + dynamic range 49152-65535 by default) between the enrolment client and the CA.

  4. During decommissioning, clean up old enrollment services objects with certutil -viewdelstore alternatives — practically: remove the retired CA from AD via the AD CS uninstall or certutil -dspublish cleanup guidance, so clients stop targeting it.

An unhandled error has occurred. Reload 🗙