Troubleshooting case study
RSOP: RPC server unavailable
RSOP failed with RPC error 0x800706BA because WS01 WMI firewall rules were disabled. Enabling the required Domain-profile rules restored WMI and Group Policy Results. Event 10067 also led to targeting the existing LocalAdmin account instead of the disabled built-in Administrator.
Environment
Personal AD lab: DC01 and the WS01 endpoint in a dedicated LAPS-Test OU; an enabled LocalAdmin account and a delegated reader group.
Diagnostic process, findings & corrective action
RSOP failed with RPC error 0x800706BA because WS01 WMI firewall rules were disabled. Enabling the required Domain-profile rules restored WMI and Group Policy Results. Event 10067 also led to targeting the existing LocalAdmin account instead of the disabled built-in Administrator.
Validation & outcome
Encrypted attribute presence, delegated retrieval, unauthorized-access denial, effective policy, and forced-rotation events support the completed Windows LAPS scope.
Lessons & limitations
Personal Active Directory lab. Evidence supports modern Windows LAPS schema extension, OU scoping, GPO configuration, encrypted AD password storage, least-privilege retrieval, negative access testing, RSOP/event validation, and forced rotation. Actual passwords are excluded.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.