Ctrlk
← 1kosmos.comResources
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Troubleshooting & Support

This page covers cross-cutting issues with 1Kosmos Windows Workstation MFA Agent, installation failures, Credential Provider service problems, log collection, and connectivity diagnostics.

Log Collection

Logs are the first resource for any diagnosis. Collect them before escalating or attempting fixes.

Log Location

C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs

Logs are written per session and rotated automatically. The most recent log file reflects the last authentication event or service activity.

Collecting Logs via PowerShell

To copy the full log directory to a staging location for review or submission:

Copy-Item -Path "C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs" -Destination "C:\Temp\1KosmosLogs" -Recurse

Enabling Verbose Logging

By default, the Credential Provider writes standard-level logs. To enable verbose logging for a specific diagnostic session:

  1. Open the registry editor and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\1KosmosCredentialProvider

  1. Set the LogLevel value to verbose.

  2. Reproduce the issue.

  3. Collect the logs from the log directory.

  4. Reset LogLevel to its previous value after collection.

Note: Verbose logging increases log volume significantly. Disable it after the diagnostic session to avoid unnecessary disk usage.

Credential Provider Service

Most login screen and authentication issues trace back to the Credential Provider service not running correctly.

Check Service Status

The service status should be Running. If it is Stopped or StartPending, proceed with the steps below.

Restart the Service

Start the Service if Stopped

Check Service Startup Type

The service should be set to start automatically:

Note: If the service fails to start repeatedly, review the Windows Event Viewer under Windows Logs > Application for error entries from 1KosmosCredentialProvider. Also check the log directory at C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs for startup errors.

Connectivity Diagnostics

Authentication methods that require network access (Push Notification, QR Code, SMS / Email / Voice OTP, online FIDO) will fail silently if the workstation cannot reach the 1Kosmos tenant.

Test Tenant Connectivity

Replace <your-tenant-hostname> with your organisation's 1Kosmos tenant hostname (e.g., tenant.1kosmos.net). A successful result shows TcpTestSucceeded : True.

Test DNS Resolution

If DNS resolution fails, the workstation cannot locate the tenant regardless of network connectivity. Verify DNS configuration on the workstation and check with your network team.

Check Certificate Trust

SSL errors between the Credential Provider and the tenant will prevent authentication. Verify the tenant's certificate is trusted by the workstation:

If this returns a certificate error, ensure the root CA for the tenant certificate is in the workstation's Trusted Root Certification Authorities store.

Proxy Environments

If the workstation connects to the internet through a proxy, the Credential Provider must be configured to route requests through it:

  1. Open the registry editor and navigate to:

  1. Set the ProxyServer value to your proxy address and port (e.g., http://proxy.corp.example.com:8080).

  2. Restart the Credential Provider service.

Installation Issues

Issue
Likely Cause
Resolution

Installer exits immediately with no error

Insufficient privileges

Run the installer as Local Administrator or via an elevated command prompt

MSI installation returns error 1603

Conflicting software; previous installation not cleanly removed; .NET dependency missing

Review the MSI log (/l*v); check for residual files in C:\Program Files\1Kosmos\1KosmosCredentialProvider; run msiexec /x on the previous version before re-installing

1Kosmos tile does not appear after installation

Installation completed but reboot not performed; Credential Provider service not running

Reboot the workstation; verify the Credential Provider service is running

Installation succeeds but REGCONFIG.ini settings not applied

REGCONFIG.ini was not in the same directory as the installer at the time of installation

Place REGCONFIG.ini alongside the installer and re-run; verify the tenant URL and tenant ID values in the file are correct

EXE installer silent flag not recognised

Incorrect flag casing or wrong installer framework

Verify the /S flag is uppercase; see Uninstall EXE for flag reference; contact 1Kosmos support if the flag is not recognised

Authentication Issues

Issue
Likely Cause
Resolution

1Kosmos tile missing on login screen

Credential Provider service not running; installation incomplete; reboot not performed after install or uninstall

Check service status; verify installation directory exists; reboot the workstation

User not found or authentication rejected

User's AD account not synced to the 1Kosmos tenant; UPN format mismatch

Verify the user exists in AdminX under Users > All Users; confirm the UPN format matches between AD and the tenant

No MFA prompt - user logs in with password only

No Adaptive Auth Journey assigned to the user or machine

Verify the user is within the assignment scope of a published journey in Applications > Windows MFA > Adaptive Auth Journeys

MFA prompt appears but all methods fail

Tenant connectivity lost; user not enrolled in the required method

Test connectivity using the steps in Connectivity Diagnostics; verify enrollment in AdminX

Authentication succeeds on mobile but Windows session does not unlock

Session timeout between mobile approval and Windows response; Credential Provider service crashed

Ensure the user completes the mobile step promptly; restart the Credential Provider service; retry

Push / QR / OTP options not appearing

Journey not configured with those methods; AD profile attributes missing for OTP

Review the assigned journey in AdminX; for OTP, verify mobile and mail attributes on the AD profile

Windows Login Screen Issues

Issue
Likely Cause
Resolution

Login screen shows no credential providers at all

Windows credential provider registration corrupted

Run sfc /scannow from an elevated command prompt; reboot; if unresolved, re-install the agent

Both 1Kosmos tile and Windows password tile visible when only one is expected

DisablePwdOnCredUI or related registry key not configured

See Configuration Reference for registry keys controlling provider visibility

Login screen freezes after clicking 1Kosmos tile

Credential Provider service deadlock; tenant unreachable causing long timeout

Restart the Credential Provider service; test tenant connectivity; review logs for timeout errors

Tile branding shows "1Kosmos" instead of "1KOSMOS"

Agent version prior to v2.4.0.0 installed

Update the agent to v2.4.0.0 or later; the tile label was updated in that release

Group Policy and Registry Issues

Issue
Likely Cause
Resolution

Registry settings applied via GPO not taking effect

GPO not linked to correct OU; GPO not refreshed on workstation

Run gpupdate /force on the workstation; verify GPO link and scope using gpresult /h report.html

REGCONFIG.ini values overwritten after GPO refresh

GPO is applying conflicting registry values

Audit GPO registry settings for the HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\1KosmosCredentialProvider path; resolve conflicts between REGCONFIG.ini-applied values and GPO-applied values

Registry key changes not reflected at login screen

Credential Provider caches configuration at service start

Restart the Credential Provider service after making registry changes

Diagnostic Checklist

Use this checklist when investigating any login or authentication failure before escalating.

Step
Check

1

Credential Provider service is running (Get-Service -Name "1KosmosCredentialProvider")

2

Workstation can reach the tenant on port 443 (Test-NetConnection)

3

DNS resolves the tenant hostname (Resolve-DnsName)

4

No certificate errors when accessing the tenant URL

5

User exists in AdminX under Users > All Users

6

An Adaptive Auth Journey is published and assigned to the user

7

Log files exist and contain recent entries in C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs

8

No errors in Windows Event Viewer under Windows Logs > Application from 1KosmosCredentialProvider

9

Workstation has been rebooted since last installation or configuration change

10

Agent version is current - check Settings > Apps for the installed version

Known Limitations

Limitation
Detail

Offline MFA

Only cached PIN (Behavior Auth & PIN) and cached Windows password are available offline; all other methods require network connectivity to the tenant

RDP without agent on destination

MFA cannot be enforced at the destination server if the Credential Provider is not installed there; see RDP / Remote Desktop

Entra ID joined machines

Not yet supported; see Entra ID Joined Machines

Local account exclusions

Only local accounts can be excluded from MFA enforcement via ExcludedAccounts; domain accounts cannot be excluded

Maximum offline PIN attempts

Cached PIN is permanently cleared after 3 failed offline attempts; online re-authentication is required to restore it

PreviousUninstall EXE
NextRelease Notes for Windows Workstation MFA

Last updated

Was this helpful?