In this article:  

• Issue description

• Prerequisites

• Possible causes

• Resolution

• Related topics and articles

• When and how to reach support

Issue description  

ADAudit Plus uses Windows services such as RPC, WMI, and DCOM to fetch security log events from configured Domain Controllers. If WMI or RPC services fail due to insufficient privileges or firewall restrictions, ADAudit Plus will be unable to establish a connection to the Domain Controller using these services. This results in the error "RPC Server Unavailable (Error Code 1722)."

Prerequisites  

Before troubleshooting, ensure that:

• The required RPC ports (135, 445, 49152-65535) and Firewall rules are not blocked bidirectionally or at least inbound on your targeted Server.

• ADAudit Plus should be able to ping the target server successfully.

Possible causes  

• Blocked RPC Ports: The necessary ports (static port 135, dynamic ports 49152-65535) are not opened in the firewall, preventing ADAudit Plus from collecting logs.

• Firewall Inbound Rules Restriction: Windows Firewall rules related to Remote Event Log Management and COM+ Network Access (DCOM-In) are not enabled.

• Name Resolution Issues: ADAudit Plus cannot resolve the flat name, FQDN, or IP of the respective Domain Controller.

• File and Printer Sharing Disabled: The required Windows feature is disabled, preventing necessary communication.

• Print Spooler Service Not Running: The service is not running on either the Print Server or the ADAudit Plus Server.

• Incorrect Printer Configuration in ADAudit Plus: The required printer queue is not configured correctly, leading to failed event capture.

• Event Viewer Connectivity Issue: ADAudit Plus cannot connect to the Event Viewer of the Print Server to fetch print-related logs.

Resolution  

Step 1: Open required RPC ports  

1. Ensure that static port 135 and dynamic ports 49152-65535 are open on monitored computers.

2. If using Windows Firewall, open the required dynamic ports by enabling these inbound rules:

• Remote Event Log Management (NP-In)

• Remote Event Log Management (RPC)

• Remote Event Log Management (RPC-EPMAP)

• COM+ Network Access (DCOM-In)

3. To enable these rules, navigate to:

• Windows Firewall > Advanced Settings > Inbound Rules

• Right-click on the respective rule and select Enable Rule

Step 2: Enable file and printer sharing  

1. Open Control Panel > Network and Sharing Center.

2. Click Change advanced sharing settings.

3. Under File and printer sharing, select Turn on file and printer sharing.

4. Click Save changes.

5. More details: Microsoft Documentation

Step 3: Restart print spooler service  

1. Open Run (Windows + R), type services.msc, and press Enter.

2. Locate Print Spooler, right-click, and select Restart.

3. Repeat the above steps on both the Print Server and ADAudit Plus Server.

Step 4: Verify printer queue in ADAudit Plus  

1. Open Settings > Printers & Scanners.

2. Select the printer from the Print Server configured in ADAudit Plus.

3. Open the print queue and send a test print from any workstation.

4. Confirm that the print appears in the queue.

Step 5: Check event viewer for print logs  

1. Open Event Viewer on the Print Server from the ADAudit Plus Server.

2. Navigate to Application and Services Logs > Microsoft > Windows > PrintService > Operational.

3. Check if the event for the test print appears (Event ID 307).

Related topics and articles  

• Microsoft Documentation on File and Printer Sharing

• Windows Firewall Rules for Remote Event Log Management

• RPC and WMI Configuration for ADAudit Plus

When and how to reach support