RPC Server Unavailable trying to connect to CA

Issue - Unable to connect to a CA using certificate authority console.

Description  - Recently, we build up a new Standalone CA. We wanted to delegate  'cert issuing' task to Help desk Team but whenever we were trying to connect to this CA console using desktop CA console, we were encountering below error. Along with above issue, neither of us were able to connect to any of the services like connecting to C drive, remote registry etc. 

Error - RPC Server Unavailable error 0x6a (WIN32: 1722)

Tried - 1. Tried disabling 'windows firewall', didn't work

            2.  Tried starting remote procedure call locator service, did not work.

            3.  Sometimes event 13 with "Server RPC is unavailable" means “access is denied”. A possible cause of this issue is that one of the following objects is not added to the Built-in\Users group:

·         NT AUTHORITY\Authenticated Users

·         NT AUTHORITY\INTERACTIVE

·         Domain Users

 In addition, verified that the DCOM permission is configured correctly on the CA server:

1)      On the server, run dcomcnfg.exe.

2)      On the Component Services console, navigate to Component Services\Computers\My Computer.

3)      Right-click My Computer, select Properties, verify that Enable Distributed COM on this computer is selected in the Default Properties tab.

4)      Click the COM Security tab, Click Edit Limits in the Access Permission section and ensure thatEveryone and Certificate Service DCOM Access has Local Access and Remote Accesspermissions.

5)      Click Edit Limits in the Launch and Activation Permission section and ensure thatCertificate Service DCOM Access group has Local Activation and Remote Activationpermissions.

6)      Click OK.

7)      Under My Computer, navigate to DCOM Config\CertSrv Request.

8)      Right-click CertSrv Request, select properties, verity that Authentication Level is set to Default and gray out in the General tab.

9)      Select the Security tab, and check if everything is disable (gray out).

Still didn’t work.

4. Verify that the following keys exist in the registry (the keys are grouped according to operating system).

Verified that the ClientProtocols key exists under the

HKEY_Local_Machine\Software\Microsoft\Rpc

registry subkey and that the ClientProtocolsentry contains at least the following five default values:

Name	Type	Data
ncacn_http	REG_SZ	rpcrt4.dll
ncacn_ip_tcp	REG_SZ	rpcrt4.dll
ncacn_nb_tcp	REG_SZ	rpcrt4.dll
ncacn_np	REG_SZ	rpcrt4.dll
ncacn_ip_udp	REG_SZ	rpcrt4.dll

 Resolution - When further dig out, we found that , RPC port was blocked By default, port 135 TCP/UDP and ports 1024-65535 TCP must be open for RPC to work. 

RPC can also take advantage of SMB sessions for the purpose of RPC communication. Some examples of this can be seen with Computer Management or the Remote Registry service. With the use of RPC over SMB , so we want 445 to be open as well. So with the help of networking team , we were able to open port 135 and 445 and everything worked fine.

Reference - 1. https://social.technet.microsoft.com/Forums/windowsserver/en-US/64cb4674-c307-43ba-a066-869d1490b50c/rpc-server-unavailable-trying-to-connect-to-ca

2. https://social.technet.microsoft.com/Forums/en-US/2b93bfa8-c162-4fc8-9cf3-a8f8f8c8ff29/rpc-server-is-unavailable-requesting-a-new-certificate?forum=winservergen

3. http://social.technet.microsoft.com/wiki/contents/articles/4494.windows-server-troubleshooting-the-rpc-server-is-unavailable.aspx

4. https://communities.bmc.com/thread/39477

5. https://support.microsoft.com/en-us/kb/839880