Octopus Windows Agent Error Code Reference

Pre-login token is invalid or doesn't match the AUTH server. Usually caused by Load Balancer sticky session issues between AUTH servers. Also, possible if an unassigned user attempts to login.

1. Check Load Balancer sticky session configuration between AUTH servers.
2. Verify the user is properly assigned/enrolled.
3. TLS reject, check your ssl setup.

The service key is corrupt, incorrect, or cannot be decoded. Also triggered by unreachable server URL, untrusted web service certificate, or proxy blocking network traffic.

1. Verify the Enterprise URL is correct and reachable.
2. Check that the Service Key is valid - do not copy it directly from the server or use Firefox (may add extra spaces).
3. Confirm the NGINX certificate is trusted.
4. Check for MS error 12002 in sdoguard*.log - this indicates a network/proxy block.

The certificate on the ADPA service doesn't match what's expected - may have been rotated or corrupted.

1. Resolution: Repackage and re-create the MSI package.
2. Workaround: Place the cert.pem file in the Octopus client directory.

The AUTH server returned a legitimate reject. Many possible reasons - check the reject code between AUTH server and Windows client.

1. Check server for legitimate reject reasons.
2. Verify user is not expired, blocked, or disabled.
3. Confirm user is enrolled and has a valid license.
4. Check if Service Bypass is active and direct AD Bind is failing.
5. Verify password exists in the vault (may be missing due to wrong Passwordless config).
6. Check FIDO device registration if applicable.

User profile is in bypass or panic mode, so Octopus app/FIDO login is not permitted during this period.

1. Login with username and password instead.
2. Contact administrator to review bypass/panic mode settings.

Bypass login attempted with FIDO is not permitted - username and password must be used.

1. Login with username and password.
2. Check sdofido*.log (C:\Windows\Temp\sdofido*.log) for details.

User bypass not allowed.

1. Login with username and password.

WebAuthn error during authentication.

1. Retry authentication.
2. Contact administrator if issue persists.

MFA bypass is not permitted for this user or policy.

1. Complete MFA authentication.
2. Contact administrator to review MFA policy.

Account is locked in Active Directory.

1. Contact administrator to unlock the AD account.
2. If MS error 1385 appears in sdoguard*.log: remove 'network LogonUser' permission under WCPS.

Client expected a challenge code from the authentication server but did not receive it.

1. Check server configuration.
2. Contact Octopus support with logs.

Invalid, wrong, or untrusted certificate used.

1. Verify certificate validity.
2. Ensure the certificate is trusted by the client.

The selected sign-in method is not permitted by policy.

1. Use an allowed sign-in method.
2. Contact administrator to review permitted methods.

Account has access restrictions.

1. Contact administrator to review account restrictions.

Bypass token not supported or wrong configuration - MFA ForceAuth bypass not allowed.

1. Contact administrator to review MFA and bypass configuration.

Azure login requires UPN (User Principal Name) format.

1. Login using UPN format: user@domain.com

Server returned incorrect data for AAL3 Enhanced Assurance.

1. Contact administrator.
2. Contact Octopus support with server logs.

Mobile device returned incorrect or no data for AAL3 Enhanced Assurance.

1. Re-enroll mobile device.
2. Contact administrator.

Verification code was not provided.

1. Enter the verification code when prompted.

Invalid application token.

1. Retry.
2. Re-authenticate.
3. Contact administrator if issue persists.

Server-side error.

1. Retry.
2. Contact Octopus support with server logs.

Attempting Passwordless/PasswordFree login but no password exists in the vault and one cannot be created.

1. Verify LDAPS (secure) is used to connect to Active Directory.
2. Confirm the AD user has permission to change passwords. There might be "Password Change" error at your authentication session on Management console Audit.
3. Ensure you are fully logging out before retrying.
4. If on Azure-joined machine, verify agent settings support Azure.
5. Check that the 'User DN' account has rights to change passwords for all users.

The private key fails to decrypt the password from the Octopus vault. May indicate TPM reset, corruption, or a security breach.

1. Check that TPM or "Support online certifcates in rdp" is not ON if it should not.
2. Contact security team if machine theft is suspected.

The last two stored passwords don't match what's in the vault. Usually caused by a password changed directly in Active Directory (bypassing Octopus sync).

1. Scenario 1 (Offline): Connect the Windows machine to the network and use ONLINE authentication.
2. Scenario 2 (Password mismatch): Reset the password using the Octopus Management Console. If that fails, remove the machine from the domain, restart, and re-join.
3. Scenario 3 (Remote user): In the mobile app, open the failing account, select 'Show Credentials', and swipe right-to-left to view the previous password.
4. Azure-joined machines: Password rotation takes time - try a second login.
5. Ensure the machine is domain-joined (non-domain machines are not supported).
6. Check for MS error 1326 in sdorest*.log (indicates account locked during login).

Timeout between the SDO Credential Provider and the SDO Safeguard Service.

1. Check the SDO Safeguard Service status.
2. Restart the service if it has stopped.

Unable to decrypt stored credentials.

1. Contact administrator.
2. May require workstation re-enrollment.

Password sync is broken between the Windows agent and the server.

1. Contact administrator.
2. Admin should reset the password from the Management Console.

Credential validation failed.

1. Retry.
2. Verify credentials are correct.
3. Contact administrator.

Incorrect credentials entered.

1. Re-enter username and password carefully.
2. Use password reset if available.

Incorrect password in Password Free mode.

1. Retry.
2. Contact administrator to sync password vault.

OTP is not supported for passwordless login.

1. Use an alternative authentication method (app push, BLE, FIDO).
2. Contact administrator to review authentication method settings.

The OTP buffer has been exhausted.

1. Authenticate online to renew your OTP token.

Too many failed OTP attempts - short lockout triggered.

1. Wait 1 minute and retry.

Repeated OTP failures - extended lockout triggered.

1. Wait 30 minutes and retry.
2. Contact administrator if urgent access is required.

Severe OTP failure pattern - maximum lockout triggered.

1. Wait 1 hour and retry.
2. Contact administrator to unlock if needed.

Account blocked due to excessive failed attempts.

1. Contact administrator to unlock the account.

No forward OTP received from server.

1. Retry with network connection.
2. Contact administrator or Octopus support.

OTP offline credential retrieval failed.

1. Connect to the network and retry.

Incorrect OTP entered.

1. Check OTP value and retry.
2. Ensure OTP has not expired.

The agent cannot find all required Octopus registry keys. Often caused by using an incorrect MSIUpdater tool or manual registry key changes.

1. Confirm you are using the correct MSIUpdater version.
2. Reinstall the MSI package.
3. Check for any manual changes to registry keys (deleted URLs or service keys).

Credential reset is not configured.

1. Contact administrator to enable credential reset.

No RADIUS token found for the user.

1. Contact administrator to configure RADIUS token.

Server address uses HTTP instead of HTTPS.

1. Update the server URL to use https://.

Application has been disabled.

1. Contact administrator to enable the application.

Insufficient memory on the Windows machine.

1. Contact your IT administrator.
2. Consider upgrading system RAM.

Unknown or unclassified error.

1. Collect logs and contact Octopus Tech Support.

Unable to write to the clipboard.

1. Retry the operation.
2. Contact administrator if issue persists.

Unable to clear the clipboard.

1. Retry the operation.
2. Contact administrator if issue persists.

Workstation lock command failed.

1. Retry.
2. Check Windows lock permissions.
3. Contact administrator.

Timeout between the SDO Credential Provider and the SDO Guard service on the Windows machine.

1. Confirm the Enterprise base URL is reachable - try opening it in a browser.
2. Verify SDOGUARD.exe service is registered and running.
3. If missing: uninstall via Control Panel and reinstall, then verify service is created.
4. Check for invalid/self-signed certificates.
5. Octopus Desk v3.5.3 and below: upgrade to v3.5.4+ to fix WMI issues (caused by Microsoft April 2022 security updates).
6. Check sdocred*.log for 'GetLogonSID Failed' to identify domain membership issues.
7. If SDOGUARD.exe crashed unexpectedly, contact Octopus support with logs.

Authentication request timed out.

1. Retry authentication.
2. Check network connectivity.
3. Verify Enterprise URL is accessible.

Certificate-based offline authentication failed.

1. Retry offline login.
2. Contact administrator if issue persists.

Offline login attempted before initial online authentication.

1. Login online at least once before using offline mode.

FIDO key hardware error, wrong PIN, blocked device, unsupported firmware, or unregistered device type.

1. Check sdofido*.log for detailed error information.
2. Verify the FIDO key is not blocked and has the correct PIN.
3. For Windows login, only Yubico devices are currently supported.
4. Ensure the user's directory (e.g. AD) has a valid email address.
5. Do not use a PIN when MFA is active - PINs are for passwordless only.
6. If firmware is outdated, contact the FIDO vendor to upgrade.
7. Resolution for password mismatch: Reset the password using the Management Console.

FIDO key is configured for BIO, but a PIN is required instead. BIO login cannot complete.

1. Enter the FIDO PIN when prompted.
2. Contact administrator to review FIDO authentication configuration.

Fingerprint reader failed.

1. Retry fingerprint scan.
2. Reset the Security key and try again.

FIDO hardware key not detected.

1. Insert the FIDO key into the USB port.
2. Try a different USB port.
3. Verify key is not damaged.

Enterprise URL is unavailable or there is no network connection and no offline fallback is configured.

1. Verify network connection.
2. Check Enterprise URL availability.
3. Configure offline login options: BLE via Octopus app, Buffered OTP, or FIDO key.

RADIUS token retrieval requires a network connection.

1. Connect to the network and retry.

VPN failed to launch.

1. Retry.
2. Check VPN configuration.
3. Contact administrator.

No network connection detected.

1. Check network cable or Wi-Fi connection.
2. Contact IT if network issues persist.

RFID reader not detected.

1. Connect RFID reader and retry.

RFID card not detected by reader.

1. Hold RFID card closer to the reader and retry.

RFID authentication is not supported on this platform.

1. Use an alternative authentication method.

No phone available to answer the auth request, wrong enrolled phone is being used, or BLE is sending an incorrect password.

1. Ensure Bluetooth is enabled on both the Windows machine and mobile device.
2. Confirm the correct enrolled phone is nearby and responsive.
3. Check BLE log at C:\Windows\Temp\sdoble*.log for more details.

User denied the BLE authentication request in the Octopus app, or an incorrect enrolled machine is being used.

1. Ensure the user approves the authentication request on their mobile.
2. Verify the correct enrolled machine is being used.
3. Try deleting the authenticator smartphone for this user.
4. If app permissions are suspected, send application logs to support.

Routine check indicating the password policy has detected an expired password. May trigger auto-lock to force rotation.

1. This is a log-level indicator - no user action needed unless a lock occurs.
2. Review password policy configuration if workstation locks unexpectedly.

Pre-check confirming password is not expired. Used to determine whether to use BLE or PUSH.

1. Informational only - no action required.

User denied the PUSH authentication request in the Octopus app, or incorrect enrolled machine is in use.

1. User should approve (not deny) the push notification.
2. Verify the correct enrolled machine.
3. Try deleting and re-enrolling the authenticator smartphone.
4. Send application log to support if issue persists.

SSH launch failed.

1. Retry.
2. Check SSH configuration.
3. Contact administrator.

Single Sign-On launch failed.

1. Retry.
2. Check SSO configuration.
3. Contact administrator.