Universal Forwarder - WMI Issue - "The RPC server is unavailable." HRESULT=800706BA

[driva]

Hi guys,

I'm using a Universal Forwarder in a remote location (different network) to try and get data into my Splunk instance. Both machines are Windows. 

The necessary firewall rules are in place and the Universal Forwarder logs show that the UF is connected to my server. However, when I look at the logs on my Splunk server, I can see the 800706BA error 'The RPC server is unavailable' 

How might I solve this problem?

Both networks are independent of one another, so I'm not sure if this is an authentication issue or not. Any tips of one the next steps might be would be great appreciated.

Many thanks!

[nwuest]

Hi @driva,

After reading your post and doing some googling of the Windows "800706BA" error especially showing up in the Splunk logs.

A few things come to mind and they are network related:

1. You speak of the necessary firewall rules are in place are you speaking of the firewall logs on the machines themselves or a firewall in between both networks?
   
   
2. Have you tried "turning off" the firewalls (AS A TEST ONLY) on either device to see if that clears up the connection issues?
   1. If the connection clears up then you can narrow it to a specific device as to which is causing the connection issues, from there it could be a routing issue or a firewall issue.
   2. If the connection does not clear up then you can confirm that the issue remains somewhere on a larger level (ie. routing between networks, firewall rules are getting in the way etc. etc.)

We do hope to hear from you and if this was helpful!

V/R,
nwuest