Event ID 29 from Microsoft-Windows-CertificateServicesClient-CertEnroll is logged when the
client works through the enrolment server endpoints associated with its certificate enrolment
policy and cannot authenticate to or reach any of them. It usually appears alongside Event 13
and carries the same underlying error (frequently 0x800706BA, RPC server unavailable). The
message tells you the client exhausted its options — the interesting part is the error code
inside it.
Event ID 29
CertEnroll Event 29: enrolment failed against all enrolment servers
What it means
Common causes
The CA (or all CAs) for the policy are unreachable — service stopped, firewall, or servers decommissioned while their AD objects remain.
The account lacks enrolment permission on every CA/template combination the policy offers.
Broken certificate enrolment policy configuration after a PKI migration — clients still point at the old environment.
How to fix it
Open the event and read the inner error code; treat
0x800706BAas a connectivity/DCOM problem (see Event 13) and access-denied codes as permission problems.List what the client believes its enrolment endpoints are:
certutil -policyservers(when enrolment policy web services are in play) or check Sites and Services > Services > Public Key Services for published enrollment services.Remove decommissioned CAs from Active Directory so clients stop trying them, and verify the surviving CA grants the account Request Certificates.