Windows Server  ·  high  ·  Directory & core infrastructure

Error 1722 — the RPC server is unavailable

The client resolved the target and tried to talk to it over RPC, and either could not connect at all or could not reach the dynamic port the endpoint mapper handed back.

What you see

Replication, Group Policy management, remote MMC consoles or dcpromo fail with 1722. Frequently intermittent, and frequently blamed on Active Directory when it is a firewall.

What is actually wrong

TCP 135 blocked, or — far more often — the ephemeral RPC range (49152–65535) blocked. A firewall that permits only 135 lets the endpoint mapper answer and then blocks the actual call.

Codes and articles

17220x6BARPC_S_SERVER_UNAVAILABLE

Fixes (2)

Open the endpoint mapper and the dynamic range
Elevated PowerShell30 minutesmedium riskreversible

A firewall sits between the two machines.

  1. Confirm port 135 is reachable.

    PowerShell
    Test-NetConnection -ComputerName DC02 -Port 135

  2. Ask the endpoint mapper what is registered — this proves RPC itself is answering.

    Command Prompt
    portqry -n DC02 -e 135 -p TCP

  3. Open the dynamic range 49152–65535 TCP between the two hosts, in both directions.

    The endpoint mapper answers on 135 with a high port for the actual call. Opening only 135 produces exactly this symptom: the connection appears to start and then fails.

  4. If the firewall cannot take that range, pin AD replication to a single port instead and open just that.

    PowerShell
    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name 'TCP/IP Port' -Value 51000 -PropertyType DWord -Force

    Do this on every DC and restart each. Pinning on some but not all produces failures that look random.

  5. Restart Active Directory Domain Services on each DC you changed.

    PowerShell
    Restart-Service NTDS -Force
Confirm it workedReplication succeeds and the port test passes.
PowerShell
repadmin /replsummaryTest-NetConnection -ComputerName DC02 -Port 51000
If you need to undo itRemove the TCP/IP Port value and restart NTDS to return to the dynamic range.
Check the RPC services and name resolution
Elevated PowerShell15 minuteslow riskreversible

No firewall in the path.

  1. Confirm the RPC services are running on the target.

    PowerShell
    Get-Service RpcSs, RpcEptMapper | Format-Table Name, Status, StartType -AutoSize

  2. Make sure the name resolves to the address you expect, and only that address.

    PowerShell
    Resolve-DnsName DC02 -Type A

    A stale A record for a decommissioned DC produces 1722 that comes and goes as the client picks different answers.

  3. Check for duplicate or leftover records for that name and remove any that are wrong.

  4. Verify time is in sync — Kerberos fails outside a five minute skew and the resulting errors include 1722.

    PowerShell
    w32tm /query /statusw32tm /monitor
Confirm it workedRemote MMC and repadmin both connect.
PowerShell
repadmin /showrepl DC02
If you need to undo itNone.

Reference

Troubleshoot RPC error 1722 — Microsoft Learn ↗

Related faults

Lingering objects and replication event 1988Windows ServerUSN rollback — event 2095 and a controller that stops replicatingWindows ServerAD replication error 8524 — the DSA operation cannot continue (DNS lookup failure)Windows ServerDNS event 4013 — waiting for Active Directory to signal it has completed initial synchronisationWindows ServerNTDS events 2087 and 2088 — DNS lookup failure caused replication to failWindows Server"Connection refused" against "No route to host" against a timeoutLinux

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.