Skip to content

Commit 038785b

Browse files
author
Simonx Xu
authored
Merge pull request #8752 from v-lianna/CI_5386
AB#5386 Create status-code-0x6ba-rpc-server-unavailable.md
2 parents 6d1dc8f + 3a776fe commit 038785b

2 files changed

Lines changed: 128 additions & 0 deletions

File tree

‎support/windows-server/active-directory/status-code-0x6ba-rpc-server-unavailable.md‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
title: Status Code 0x6ba and the RPC Server Is Unavailable
3+
description: Provides troubleshooting steps for resolving the remote procedure call (RPC) status code 0x6ba when you join a workgroup computer to a domain.
4+
ms.date: 04/24/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, raviks, herbertm, dennhu, eriw, v-lianna
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Status code 0x6ba: The RPC server is unavailable
14+
15+
This article provides troubleshooting steps for resolving the remote procedure call (RPC) status code 0x6ba when you join a workgroup computer to a domain.
16+
17+
When you join a workgroup computer to a domain, you receive the following error message:
18+
19+
> Changing the Primary Domain DNS name of this computer to "" failed. The name will remain "\<DomainName\>".
20+
> The error was:
21+
>
22+
> The RPC service is unavailable.
23+
24+
Here's more information about the error code:
25+
26+
|Hexadecimal error |Decimal error |Symbolic error string |Error description |
27+
|---------|---------|---------|---------|
28+
|0x6ba |1722 |RPC_S_SERVER_UNAVAILABLE |The RPC server is unavailable. |
29+
30+
When you check the **NetSetup.log** file, you see the following entries. For example:
31+
32+
```output
33+
NetpGetComputerObjectDn: Unable to bind to DS on '\\DCNAME': 0x6ba
34+
NetpCreateComputerObjectInDs: NetpGetComputerObjectDn failed: 0x6ba
35+
NetpProvisionComputerAccount: LDAP creation failed: 0x6ba
36+
ldap_unbind status: 0x0
37+
NetpJoinCreatePackagePart: status:0x6ba.
38+
NetpJoinDomainOnDs: Function exits with status of: 0x6ba
39+
NetpJoinDomainOnDs: status of disconnecting from '\\DCNAME': 0x0
40+
NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on 'DOMAINNAME' returned 0x0
41+
NetpJoinDomainOnDs: NetpResetIDNEncoding on 'DOMAINNAME': 0x0
42+
NetpDoDomainJoin: status: 0x6ba
43+
```
44+
45+
## Troubleshoot the connection issue
46+
47+
To troubleshoot this issue, use the following steps:
48+
49+
1. Check the **NetSetup.log** file (**C:\\Windows\\Debug\\NetSetup.log**) on the client machine, and confirm if the domain controller (DC) locator process has successfully located a DC. However, the client machine fails to bind to the DC with status code 0x6ba. For example:
50+
51+
```output
52+
NetpJoinDomainOnDs: status of connecting to dc '\\DCNAME': 0x0
53+
NetpGetComputerObjectDn: Unable to bind to DS on '\\DCNAME': 0x6ba
54+
```
55+
56+
2. Make sure the network ports aren't blocked by a firewall or third-party application that is listening on the required ports of the DC (identified in step 1).
57+
58+
The endpoint mapper (listening on port 135) tells the client which randomly assigned port a service is listening on. Check the following ports:
59+
60+
|Server port |Service/Protocol |
61+
|---------|---------|
62+
|Transmission Control Protocol (TCP) 135 |RPC Endpoint Mapper |
63+
|TCP 49152 - 65535 |RPC (dynamic ports allocation) |
64+
|TCP 445 |Server Message Block (SMB) |
65+
|User Datagram Protocol (UDP)/TCP 389 |Lightweight Directory Access Protocol (LDAP) |
66+
67+
Refer to the list of required ports in [How to configure a firewall for Active Directory domains and trusts](config-firewall-for-ad-domains-and-trusts.md).
68+
69+
3. Identify if a port is blocked on a DC by using the [PortQry](https://www.microsoft.com/download/details.aspx?id=17148) command-line tool. For more information, see [Using the PortQry command-line tool](../networking/portqry-command-line-port-scanner-v2.md).
70+
71+
Here are some example syntaxes:
72+
73+
> [!NOTE]
74+
> Replace \<problem_server\> with the DC name identified in step 1.
75+
76+
- `portqry -n <problem_server> -e 135`
77+
- `portqry -n <problem_server> -e 445`
78+
- `portqry -n <problem_server> -e 389`
79+
- `portqry -n <problem_server> -p UDP -e 389`
80+
- `portqry -n <problem_server> -r 49152:65535`
81+
82+
Here are some example outputs:
83+
84+
If the connection to TCP 135 port on the DC is blocked, you see the following output:
85+
86+
```output
87+
C:\PortQryV2>portqry -n dc2 -e 135
88+
Querying target system called:
89+
Dc2
90+
Attempting to resolve name to IP address…
91+
Name resolved to 192.168.1.2
92+
querying...
93+
TCP port 135 <epmap service>: FILTERED
94+
```
95+
96+
If the connection to TCP 389 port on the DC is successful, you see the following output:
97+
98+
```output
99+
C:\PortQryV2>portqry -n dc2 -e 389
100+
Querying target system called:
101+
Dc2
102+
Attempting to resolve name to IP address…
103+
Name resolved to 192.168.1.2
104+
querying...
105+
TCP port 389 <ldap service>: LISTENING
106+
```
107+
108+
4. Collect a network trace when reproducing the issue to double check the network connectivity. You can use `netsh trace` to generate an ETL file, and [convert the ETL file to a PCAP file](https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/converting-etl-files-to-pcap-files/1133297), which Wireshark can read.
109+
110+
For example, the following network trace collected by the PortQry command-line tool might indicate there's a network connectivity issue from the client machine to the DC's TCP 135 port (RPC).
111+
112+
```output
113+
PortQry.exe CLIENT DC TCP TCP:Flags=CE....S., SrcPort=51542, DstPort=DCE endpoint resolution(135), PayloadLen=0, Seq=4232829278, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192 {TCP:16, IPv4:15}
114+
PortQry.exe CLIENT DC TCP TCP:[SynReTransmit #50]Flags=CE....S., SrcPort=51542, DstPort=DCE endpoint resolution(135), PayloadLen=0, Seq=4232829278, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192 {TCP:16, IPv4:15}
115+
PortQry.exe CLIENT DC TCP TCP:[SynReTransmit #50]Flags=......S., SrcPort=51542, DstPort=DCE endpoint resolution(135), PayloadLen=0, Seq=4232829278, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192 {TCP:16, IPv4:15}
116+
In the network trace collected on the client side, you see the retransmit package of TCP SYN to DC's TCP 135 port. And no response is received from DC.
117+
In the network trace collected on the DC side, you might not see the TCP SYN package from the client. It might be blocked by a firewall or middle device.
118+
```
119+
120+
5. Check the network device and firewall between the client and the DC to further investigate the network connectivity issue if necessary.
121+
122+
## More information
123+
124+
- [How to configure a firewall for Active Directory domains and trusts](config-firewall-for-ad-domains-and-trusts.md)
125+
- [Locating Active Directory domain controllers in Windows and Windows Server](/windows-server/identity/ad-ds/manage/dc-locator?tabs=dns-based-discovery)
126+
- [Troubleshoot domain controller location issues in Windows](../windows-security/troubleshoot-domain-controller-location-issues.md)

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,8 @@ items:
369369
href: ./active-directory/status-code-0x32-cannot-join-domain.md
370370
- name: Status code 0x3a
371371
href: ./active-directory/status-code-0x3a-server-not-perform-operation.md
372+
- name: 'Status code 0x6ba: The RPC server is unavailable'
373+
href: ./active-directory/status-code-0x6ba-rpc-server-unavailable.md
372374
- name: Support boundaries for Active Directory over NAT
373375
href: ./active-directory/support-for-active-directory-over-nat.md
374376
- name: '"The account is not authorized to login from this station" error'

0 commit comments

Comments
 (0)