Windows Identity Client Troubleshooting

Problems seen with Monofor Identity Client for Windows 2.4.22, how to diagnose them and how to fix them. Run all commands in an elevated PowerShell. Installation and settings: Windows Identity Client. User flows: Windows Identity Client Passwordless Login.

First steps

1. Note the time, the Windows user and the computer name of the failed logon.

2. Look at the Monosign audit log for that user and time (see Read the audit log). In most cases it already names the cause.

3. If not, turn on debug logs, reproduce the problem once and collect the logs.

4. Check the client version: reg query "HKLM\SOFTWARE\Monofor\Identity Client" /v Version.

Debug logs

Turn on

reg add "HKLM\SOFTWARE\Monofor\Identity Client" /v DebugMode /t REG_SZ /d 1 /f

• Takes effect at once; no restart is needed. Lock the screen and reproduce.

• An Identity Client policy with Debug Mode sets this value for you, and also switches it back. If the value keeps returning to 0, turn Debug Mode on in the policy instead.

• Turn it off afterwards (/d 0). Logs grow quickly and contain user names.

Files

Folder: C:\Program Files\Monofor\Identity Client\Logs (value LogDirectory). One file per component and day, NAME_YYYY_MM_DD.log:

Collect

$out = "$env:TEMP\monofor-identity-logs"
New-Item -ItemType Directory -Force $out | Out-Null
Copy-Item "C:\Program Files\Monofor\Identity Client\Logs\*" $out
Copy-Item "$env:WINDIR\System32\monofor-identity-security.ini" $out -ErrorAction SilentlyContinue
Get-CimInstance Win32_Service -Filter "Name like 'MonoforIdentity%'" | Select Name,State,StartMode | Out-File "$out\services.txt"
certutil -scinfo -silent > "$out\scinfo.txt" 2>&1
Compress-Archive "$out\*" "$env:TEMP\monofor-identity-logs.zip" -Force

Send the zip through a secure channel: the logs name users and computers.

Read the audit log

Management > Audits, filtered by the user. The Windows client's events arrive up to a minute later than the logon (they are queued and sent every 30 seconds). Open Data for the details.

Enrollment failure stage and code (Next release)

From the next release Smart Card Enrollment Failed carries stage, code and message, ends with Windows logon stopped. when the logon could not continue, and is written once per 24 hours per user for the same failure (repeat = how many were skipped).

Useful log lines

Problems

No Monosign tile after installation

• The feature was not selected: reinstall with FEATURES="PWLESS,PWLESS_QR".

• Check that the provider is registered: reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{0133CABD-42B6-4216-BC32-0000000003F0}".

• You are in a remote desktop session: QR and Push tiles are console only.

The QR tile is offline or shows no QR code

• Monosign not reachable at the logon screen: DNS, proxy, firewall; on 802.1X networks the network must be up before logon. Log: NetworkState, IsNetworkConnected.

• signin refused … InvalidAppKey: the key is disabled, expired, or the secret on the computer is wrong (often after a reinstall with a new key). Check the key in Management and reinstall with the correct values.

• TLS Verification is on in the Identity Client policy and the computer does not trust the Monosign certificate chain: fix the chain or turn the option off in the policy.

• With Cisco Secure Client NAM, collect the QR and Service logs with Debug Mode on and contact support.

The phone approves but the computer shows "Unable to enroll"

The certificate could not be enrolled. Find the cause:

1. Audit: Smart Card Enrollment Failed (next release: stage and code, table above).

2. MONOSIGN_CP_QR_*: lines after Certificate enrollment started.

3. MONOFOR_ID_OPR_*: EnrollUser: CA disposition=….

Most common: template permission (0x80094012), wrong enrollment account password (0x8007042D), the computer cannot reach the CA, the user is not from an AD user source, the key lacks System.API.UserCertificates.Enrollment.

Check the certificate infrastructure by hand on the computer (certmgr.msc > Personal > Certificates > All Tasks > Request New Certificate): Monofor Identity - Enrollment and Monofor Identity - Client must be listed. If the request fails, the computer cannot reach AD CS.

Smart card logon refused after the approval

The certificate was issued, but the domain controller refuses it. Windows shows an error such as "The user name or password is incorrect" or a smart card error; audit Login Error with stage: windows_logon; QR log ReportResult: ntsStatus ….

• The issuing CA is not in the enterprise NTAuth store, or its root is not trusted by the domain controllers.

• The domain controllers have no valid domain controller / Kerberos authentication certificate.

• The domain controller cannot check revocation of the user certificate (CRL not reachable).

• The certificate lacks the Smart Card Logon EKU: the Monofor Identity - Client template must have the purpose Signature and smartcard logon.

Push tile says "Please use QR authentication first."

Push never enrolls a certificate. Sign in on this computer with the QR code once; Push works afterwards.

"User Enrollment Required. Please connect your corporate network and try it again."

The client could not read the user's UPN from Active Directory. Connect the computer to the corporate network or VPN before logon and try again. After one success the UPN is cached.

Every logon tries a new enrollment and fails; "AskForCard failed" in the log

The TPM virtual smart card was removed after installation (TPM cleared, firmware update, cloned disk image). Log: VirtualSmartCard: … device=NOT PRESENT. Recreate it:

& "C:\Program Files\Monofor\Identity Client\monofor-tpm-service.exe" install

Check: MONOFOR_TPM_*.log shows Virtual smart card recreated.; Get-PnpDevice -Class SmartCardReader lists the virtual reader. The next QR logon enrolls a new certificate. Do not run it while the card is still present.

The installer reports that the TPM step failed

The installation is complete but the virtual smart card is missing (often installation from a remote desktop session). Run monofor-tpm-service.exe install as above from the console.

Enrollment fails right after an upgrade

Restart the computer so the logon screen loads the new version. If it repeats, reinstall.

The QR tile is missing after unlocking with a password and locking again

2.4.22: the QR tile may not be shown again on the same lock screen. Sign out (not lock) or restart once. Fixed in the next release.

Remote lock does not work

• The key lacks System.API.UserDevices.LockUnlock.Status (log lock-status HTTP 403). The client picks up the permission without a restart.

• The user has no registered device on this computer yet: sign in with QR once.

Windows events are missing from the audit log

• Wait a minute: events are sent every 30 seconds, and only while Monosign is reachable.

• The key lacks System.API.AuditTypes.List or System.API.Audits.Create; the events wait in ~monosign-audit*.jsonl.

• The Monosign server does not know an audit type of a newer client (server older than the client): the service log says Unknown audit type … dropping event. Update the server, then restart the Monofor Identity - Service.

Changed texts or logo do not appear

Texts are downloaded up to 15 minutes after a change, the logo within minutes. Restart Monofor Identity - Service to refresh at once. Logs: Language package saved to …, Branding watermark cached ….

Nobody can sign in

For example the password tile is hidden (Hide Other Logon Options) and Monosign is unreachable. Users with a Device PIN can still use offline sign-in. Otherwise start in Safe Mode, sign in with a local administrator and remove the Monofor provider keys as described on Windows Identity Client (Uninstall and recovery).

Useful checks