I have two thoughts on this.
- less likely unless there are firewalls involved - Newer versions of windows use different ranges of ephemeral ports for RPC.
- more likely - Differences between security posture of older versions of OS to newer
Eitherway, we may need more detailed infromation on warnings and errors in the event log during the enrolment attempts. Also details about are these auto enrol/renew or manually triggered. Any changes to templates, etc.