> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/troubleshooting-and-support.md). # Troubleshooting & Support *** ### Log Collection Logs are the first resource for any diagnosis. Collect them before escalating or attempting fixes. #### Log Location ```bash C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs ``` Logs are written per session and rotated automatically. The most recent log file reflects the last authentication event or service activity. #### Collecting Logs via PowerShell To copy the full log directory to a staging location for review or submission: ```bash Copy-Item -Path "C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs" -Destination "C:\Temp\1KosmosLogs" -Recurse ``` #### Enabling Verbose Logging By default, the Credential Provider writes standard-level logs. To enable verbose logging for a specific diagnostic session: 1. Open the registry editor and navigate to: ```bash HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\1KosmosCredentialProvider ``` 2. Set the `LogLevel` value to `verbose`. 3. Reproduce the issue. 4. Collect the logs from the log directory. 5. Reset `LogLevel` to its previous value after collection. {% hint style="info" %} **Note:** Verbose logging increases log volume significantly. Disable it after the diagnostic session to avoid unnecessary disk usage. {% endhint %} *** ### Credential Provider Service Most login screen and authentication issues trace back to the Credential Provider service not running correctly. #### Check Service Status ```bash Get-Service -Name "1KosmosCredentialProvider" ``` The service status should be `Running`. If it is `Stopped` or `StartPending`, proceed with the steps below. #### Restart the Service ```bash Restart-Service -Name "1KosmosCredentialProvider" -Force ``` #### Start the Service if Stopped ```bash Start-Service -Name "1KosmosCredentialProvider" ``` #### Check Service Startup Type The service should be set to start automatically: ```bash Set-Service -Name "1KosmosCredentialProvider" -StartupType Automatic ``` {% hint style="info" %} **Note:** If the service fails to start repeatedly, review the Windows Event Viewer under **Windows Logs > Application** for error entries from `1KosmosCredentialProvider`. Also check the log directory at `C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs` for startup errors. {% endhint %} *** ### Connectivity Diagnostics Authentication methods that require network access (Push Notification, QR Code, SMS / Email / Voice OTP, online FIDO) will fail silently if the workstation cannot reach the 1Kosmos tenant. #### Test Tenant Connectivity ```bash Test-NetConnection -ComputerName -Port 443 ``` Replace `` with your organisation's 1Kosmos tenant hostname (e.g., `tenant.1kosmos.net`). A successful result shows `TcpTestSucceeded : True`. #### Test DNS Resolution ```bash Resolve-DnsName ``` If DNS resolution fails, the workstation cannot locate the tenant regardless of network connectivity. Verify DNS configuration on the workstation and check with your network team. #### Check Certificate Trust SSL errors between the Credential Provider and the tenant will prevent authentication. Verify the tenant's certificate is trusted by the workstation: ```bash $url = "https://" Invoke-WebRequest -Uri $url -UseBasicParsing ``` If this returns a certificate error, ensure the root CA for the tenant certificate is in the workstation's Trusted Root Certification Authorities store. #### Proxy Environments If the workstation connects to the internet through a proxy, the Credential Provider must be configured to route requests through it: 1. Open the registry editor and navigate to: ```bash HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\1KosmosCredentialProvider ``` 2. Set the `ProxyServer` value to your proxy address and port (e.g., `http://proxy.corp.example.com:8080`). 3. Restart the Credential Provider service. ### Installation Issues | Issue | Likely Cause | Resolution | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Installer exits immediately with no error | Insufficient privileges | Run the installer as Local Administrator or via an elevated command prompt | | MSI installation returns error 1603 | Conflicting software; previous installation not cleanly removed; .NET dependency missing | Review the MSI log (`/l*v`); check for residual files in `C:\Program Files\1Kosmos\1KosmosCredentialProvider`; run `msiexec /x` on the previous version before re-installing | | 1Kosmos tile does not appear after installation | Installation completed but reboot not performed; Credential Provider service not running | Reboot the workstation; verify the Credential Provider service is running | | Installation succeeds but `REGCONFIG.ini` settings not applied | `REGCONFIG.ini` was not in the same directory as the installer at the time of installation | Place `REGCONFIG.ini` alongside the installer and re-run; verify the tenant URL and tenant ID values in the file are correct | | EXE installer silent flag not recognised | Incorrect flag casing or wrong installer framework | Verify the `/S` flag is uppercase; see Uninstall EXE for flag reference; contact 1Kosmos support if the flag is not recognised | ### Authentication Issues | Issue | Likely Cause | Resolution | | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | 1Kosmos tile missing on login screen | Credential Provider service not running; installation incomplete; reboot not performed after install or uninstall | Check service status; verify installation directory exists; reboot the workstation | | User not found or authentication rejected | User's AD account not synced to the 1Kosmos tenant; UPN format mismatch | Verify the user exists in AdminX under **Users > All Users**; confirm the UPN format matches between AD and the tenant | | No MFA prompt - user logs in with password only | No Adaptive Auth Journey assigned to the user or machine | Verify the user is within the assignment scope of a published journey in **Applications > Windows MFA > Adaptive Auth Journeys** | | MFA prompt appears but all methods fail | Tenant connectivity lost; user not enrolled in the required method | Test connectivity using the steps in [Connectivity Diagnostics](#connectivity-diagnostics); verify enrollment in AdminX | | Authentication succeeds on mobile but Windows session does not unlock | Session timeout between mobile approval and Windows response; Credential Provider service crashed | Ensure the user completes the mobile step promptly; restart the Credential Provider service; retry | | Push / QR / OTP options not appearing | Journey not configured with those methods; AD profile attributes missing for OTP | Review the assigned journey in AdminX; for OTP, verify `mobile` and `mail` attributes on the AD profile | ### Windows Login Screen Issues | Issue | Likely Cause | Resolution | | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | Login screen shows no credential providers at all | Windows credential provider registration corrupted | Run `sfc /scannow` from an elevated command prompt; reboot; if unresolved, re-install the agent | | Both 1Kosmos tile and Windows password tile visible when only one is expected | `DisablePwdOnCredUI` or related registry key not configured | See Configuration Reference for registry keys controlling provider visibility | | Login screen freezes after clicking 1Kosmos tile | Credential Provider service deadlock; tenant unreachable causing long timeout | Restart the Credential Provider service; test tenant connectivity; review logs for timeout errors | | Tile branding shows "1Kosmos" instead of "1KOSMOS" | Agent version prior to v2.4.0.0 installed | Update the agent to v2.4.0.0 or later; the tile label was updated in that release | *** ### Group Policy and Registry Issues | Issue | Likely Cause | Resolution | | ---------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Registry settings applied via GPO not taking effect | GPO not linked to correct OU; GPO not refreshed on workstation | Run `gpupdate /force` on the workstation; verify GPO link and scope using `gpresult /h report.html` | | `REGCONFIG.ini` values overwritten after GPO refresh | GPO is applying conflicting registry values | Audit GPO registry settings for the `HKEY_LOCAL_MACHINE\SOFTWARE\1Kosmos\1KosmosCredentialProvider` path; resolve conflicts between `REGCONFIG.ini`-applied values and GPO-applied values | | Registry key changes not reflected at login screen | Credential Provider caches configuration at service start | Restart the Credential Provider service after making registry changes | ### Diagnostic Checklist Use this checklist when investigating any login or authentication failure before escalating. | Step | Check | | ---- | ------------------------------------------------------------------------------------------------------- | | 1 | Credential Provider service is running (`Get-Service -Name "1KosmosCredentialProvider"`) | | 2 | Workstation can reach the tenant on port 443 (`Test-NetConnection`) | | 3 | DNS resolves the tenant hostname (`Resolve-DnsName`) | | 4 | No certificate errors when accessing the tenant URL | | 5 | User exists in AdminX under **Users > All Users** | | 6 | An Adaptive Auth Journey is published and assigned to the user | | 7 | Log files exist and contain recent entries in `C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs` | | 8 | No errors in Windows Event Viewer under **Windows Logs > Application** from `1KosmosCredentialProvider` | | 9 | Workstation has been rebooted since last installation or configuration change | | 10 | Agent version is current - check **Settings > Apps** for the installed version | *** ### Known Limitations | Limitation | Detail | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Offline MFA | Only cached PIN (Behavior Auth & PIN) and cached Windows password are available offline; all other methods require network connectivity to the tenant | | RDP without agent on destination | MFA cannot be enforced at the destination server if the Credential Provider is not installed there; see [RDP / Remote Desktop](/authentication/windows-workstation-mfa/deployment-scenarios/rdp.md) | | Entra ID joined machines | Not yet supported; see[ Entra ID Joined Machines](/authentication/windows-workstation-mfa/deployment-scenarios/entra-joined-workstations.md) | | Local account exclusions | Only local accounts can be excluded from MFA enforcement via `ExcludedAccounts`; domain accounts cannot be excluded | | Maximum offline PIN attempts | Cached PIN is permanently cleared after 3 failed offline attempts; online re-authentication is required to restore it | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/troubleshooting-and-support.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.