Role configuration for Network Device Enrollment Service (NDES) fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)".

Assume the following scenario:

• One installs a Network Device Enrollment Service (NDES) server
• One has the necessary permissions to install the role (local administrator, enterprise administrator)
• The role configuration fails with the following error message:

The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_SERVER_UNAVAILABLE)

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

Cause

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

This error occurs when the NDES server cannot communicate with the certificate authority via TCP port 445.

During the role configuration of NDES, some changes are made to the certification authority by the NDES installation routine:

• Add the CEP Encryption, Exchange Enrollment Agent (Offline Request), and IPSec (Offline Request) certificate templates.
• Furthermore, the registration of the certification authority is configured so that the OID 2.5.4.5 is entered in the SubjectTemplate value.

For this, NDES installation routine must be able to communicate with the certification authority via RPC named pipes. This communication takes place via TCP port 445.

The corresponding rule in the Windows firewall is called "Certification Authority Enrollment and Management Protocol (CERTSVC-RPC-NP-IN)" and must be enabled.

Related links:

• Required firewall rules for the Network Device Enrollment Service (NDES)
• Role configuration for the Network Device Enrollment Service (NDES) fails with error message "Failed to enroll RA certificates. The RPC server is unavailable. 0x800706ba (Win32: 1722 RPC_S_SERVER_UNAVAILABLE)".