Troubleshooting Omnissa Workspace ONE Assist

If you are having issues with your Workspace ONE Assist performance or service, consider troubleshooting your issue before calling support.

These troubleshooting steps address the most common issues with the Workspace ONE Assist service. The problems below are grouped by category. Some problems may have more than one possible cause and solution.

Generate Certificates

Problem

While running the "Certificate Seed Script.sql" file in Step 10 of the Generate Workspace ONE Assist Certificates task, you might see an error. This error reads "The conversion of a varchar data type to a datetime data type resulted in an out-of-range value."

Possible cause

Such an error is likely the result of a difference in locale between the machine upon which the SQL script was generated and the database server on which it is being run.

Solutions

There are two possible solutions.

• Ensure that the same date format is set in the SQL script by running the cert provisioning tool on a machine with the same locale settings as the database server.

OR (if the first solution is not possible).

• Manually edit the date format in the SQL script. For more information about date formats, see http://www.sql-server-helper.com/tips/date-formats.aspx. References in this documentation to any specific service provider, manufacturer, company, product, service, setting, or software do not constitute an endorsement or recommendation by Omnissa. Omnissa cannot be held liable for any damages, including without limitation any direct, indirect, incidental, special, or consequential damages, expenses, costs, profits, lost savings or earnings, lost or corrupted data, or other liability arising out of or related in any way to information, guidance, or suggestions provided in this documentation.

Remote Management Not Available - Device Registration Issues

Problem - Workspace ONE Assist Link Does Not Display in Workspace ONE UEM

The "Remote Management" link does not display in the More Actions drop-down menu as seen in the Device Details View OR the device is not shown in the Device List View.

Possible cause

Registration failed or Intelligent Hub might not have been deployed properly. Intelligent Hub might have not been installed on the device properly or registration to Workspace ONE Assist Server has failed.

Solution

Attempt to re-register the device. Update the Resource portal to ensure that Intelligent Hub can be properly downloaded and installed on the device. A Workspace ONE UEM administrator must re-register the device.

Problem - Registration Check Returns Failed

The device does not register with Workspace ONE UEM or the Workspace ONE Assist portal.

Possible cause

P7b file missing root/intermediate certificates in the certificate chain. In the MMC (Microsoft Management Console) certificate console when opening the certificate, the certificate path is missing, and the certificate status displays: the issue of this certificate can not be found.

Solution

Reinstall the certificate including the intermediate and root certificates. Reinstall all the certificates for this client and ensure that the root certificate is placed into the root certificate folder and the intermediate certificate is placed in the intermediate certificate folders in the MMC certificate console.

For more information about the device registration failed error, see the knowledge base article, 'Device registration check failed' error is displayed in Workspace ONE UEM Console when initiating a remote session on enrolled devices.

Problem - Error Message, 'Registration Failed: Server Not Found

The device does not register with Workspace ONE UEM or the Workspace ONE Assist portal.

Possible cause 1

Workspace ONE Assist Site URL capital and lower-case letters. In Workspace ONE Assist tool versions 4.4.2.6291 and prior, the URL for the remote management server is CAPS sensitive. In the example shown below, the URL uses upper-case and lower-case letters ‘https://rmSTAGE01.awmdm.com’.

Solution 1

Remove upper case characters from the Workspace ONE Assist site URL. Review the Workspace ONE Assist site configuration. You must ensure that the URL has all lower-case letters. In the example above, the URL must be ‘https://rmstage01.awmdm.com’.

Possible cause 2

The firewall is ON but misconfigured. If the firewall is incorrectly configured on the Workspace ONE Assist Server, it might be preventing device registrations from being received.

Solution 2

Turn off the firewall or set up exceptions. When the firewall is on and it is not correctly configured, it might be preventing device registrations. Devices register with the Anchor web service, hosted on port 443 on the Workspace ONE Assist server. If this port is blocked on the firewall, registrations are jeopardized. Turn off the firewall and see if registrations succeed. If they do, review the exceptions to ensure that the Anchor web service on port 443 or another port defined for this service is in the list of exceptions.

Problem - Error Message, "RM failed to register. Certificate invalid server."

Possible Cause:

The device fails to register because the Assist agent does not trust the enrollment certificate. This certificate was bundled in the Workspace ONE Assist installer up to version 20.07 and had to be updated periodically.

Note: This error does not apply to iOS.

Solution:

To resolve this error, upgrade the Workspace ONE Assist agent to v20.11 or later. If the issue persists, please contact Workspace ONE Support.

Workspace ONE Assist Agent v20.11 has removed the dependency on the deployment certificate on all platforms (Android, Windows, macOS, iOS, and Windows CE). Instead, the Assist Agent builds the certificate chain with the embedded root and intermediaries; and receives the deployment and leaf certificates from the Assist server. This implementation ensures that the Assist application only makes enrollment requests to a trusted Workspace ONE Assist server, and all connections are secure.

Issues Connecting to Devices

If you are having connectivity issues with your Workspace ONE Assist performance or service, consider troubleshooting your issue before calling support. These troubleshooting steps address the most common connectivity issues with the Workspace ONE Assist service.

Problem - Browser Window Does Not Open Remote Management Portal

The Workspace ONE Assist portal is not opening on the Workspace ONE UEM users’ browser window.

Possible cause 1

Incompatible web browser. The browser being used by Support staff is not compatible with Workspace ONE Assist.

Solution 1

Use a different web browser. Install or switch to a compatible browser. The following is a list of browsers currently supported by the Workspace ONE Assist Tool.

• Google Chrome
• Safari

Possible cause 2

Browser pop-ups are blocked. The browser being used is blocking pop-up windows from the Workspace ONE Assist portal.

Solution 2

Enable pop-ups in browser settings. UEM console users must update their browser settings to allow pop-ups from the Workspace ONE Assist portal.

Problem - Remote Support Validation Fails

During Workspace ONE Assist validation steps, one or all three validation steps and the ‘Launch Session’ button does not appear.

Possible cause(s): Certificate mismatch, Workspace ONE Assist server issues. Client-server certificates might be incorrectly deployed or there might be issues with the availability of Workspace ONE Assist server and console.

Solution: Review certificates and ensure that Workspace ONE Assist servers are operational. Ensure that the T10 interface certificate has been properly deployed on the Workspace ONE Assist servers, and ensure that Workspace ONE Assist servers are online and operational.

Modify Database Record for Multi-Node Configuration

For the Workspace ONE Assist server to operate correctly in a multi-node configuration, you might need to modify DB records in [ApAdmin].[dbo].[Server].[FQDN]. Some installations result in these tables pointing to the external Virtual IP (VIP) address by default. This default arrangement must be changed.

Note: Active-passive configurations with standard, all-in-one installations do not need this FQDN change inside the database table. Applying this change in such an environment might break the configuration. Consult with support if you are unsure which configuration you have.

Ensure that each [FQDN] record is in the [ApAdmin].[dbo].[Server] table in the database points to the internal IP address of the VIP (also known as Virtual IP) for the load-balanced pool.

The number of [FQDN] records is equal to the number of application/connection proctor servers in your deployment. Therefore, you must update each one in the table. For example, if your deployment has four connection proctor servers, then you must locate and modify 4 [FQDN] records in the [ApAdmin].[dbo].[Server] table.

After you finish the record modification, restart all Workspace ONE Assist Servers.

Assist System or Operations Management and Troubleshooting

• Ability to reset passwords

  To reset the password for self-managed user credentials, follow the procedure:

  1. On the Core server (multi-node deployment), navigate to the Installer file.

  2. Right-click the installer file, svrcfg.exe and select Run as administrator.

     Note:

     • Executing the ServiceConfig file does not trigger the re-installation of Assist. After you complete step 7, you may close the installer UI.
     • Ignore any unhandled exceptions shown.

  3. Select Standard Installation and then click Next. Selecting this installation type does not impact the existing installation.

  4. If the HTTPS port in use prompts, enter a different port. This does not impact the existing installation.

  5. Enter the SQL Server details.

  6. In the Portal Advanced Settings, click Show Optional settings.

  7. Navigate to the Password Managementsection.

     1. Reset password for Assist System Management (AdminWebPortal) - Enter the existing username and a new password and then click Reset.
     2. Reset password for Assist Management Portal (MgmtWebPortal) Tenant Url (Assist URL)- Enter the existing username and a new password and then click Reset.

• Enable Admin Web Portal Access

  If the deployment has more than one portal server, you must follow the procedure on all the Portal servers.

  1. On the Core server (multi-node deployment), navigate to the Installer file.

  2. Right-click the installer file, svrcfg.exe and select Run as administrator.

     Note:

     • Executing the ServiceConfig file does not trigger the re-installation of Assist. After you complete step 7, you may close the installer UI.
     • Ignore any unhandled exceptions shown.

  3. Select Standard Installation and then click Next. Selecting this installation type does not impact the existing installation.

  4. If the HTTPS port in use prompts, enter a different port. This does not impact the existing installation.

  5. Enter the SQL Server details.

  6. In the Portal Advanced Settings, click Show Optional settings.

  7. Select the Enable Portal Access check box and choose a time frame (in hours) until when the portal must be accessible for troubleshooting or management purposes.

Assist Upgrade issues

Problem

'Undefined' error shown during Core service components installation and unable to upgrade the Workspace ONE Assist system.

Possible cause

The generated self-signed assist installer root certificate may not have been updated in the database or the SQL scripts were not deployed properly.

Solution

1. Remove the listed records from the database.

   • Apadmin > Version table > Delete the version number 3 record

     DELETE from ApAdmin.dbo.[Version] where [Version] = '3'

   • Apadmin > DefaultServiceConfiguration table > Delete the param name ":ctl.svc.ipc.cert/deployment/root/v2" record

     DELETE from ApAdmin.dbo.[DefaultServiceConfiguration] where [ParamName] = ':ctl.svc.ipc.cert/deployment/root/v2'

2. Re-run the Workspace ONE Assist installer.

Problem

The error message 'Connection closed abnormally' appears while initiating a remote session when the connection is still in the 'sending message' step on the console.

Possible solution

The Reserved URL for the ToolController service might not have been configured properly during installation.

Solution

First, check the reserved URL for ToolController by the running following command to make sure the toolcontroller URL is added.

netsh http show urlacl

If the URL is not configured for ToolController then add the reserved URL by running the following command on the system.

netsh http add urlacl url=https://+:<PORT>/toolcontroller user="NETWORK SERVICE"

Check the remote connection.

Problem

The error 'Invalid Admin Credentials' was observed during Portal service installation.

Possible cause

Some unsupported special characters are used within the password for Users under User Management Settings.

Solution

Reinstall the installer by creating the new user by replacing 'Rootadmin' and 'Opsadmin' with other names such as 'Rootadmin1' and 'Opsadmin1'. You must ensure their passwords do not have characters like plus (+), double quotes ("), or hash (#) symbols.

For more information, see Install Workspace ONE Assist to an On-Premises Environment.

Problem

• IIS App Pool - 'PortalWebSite' crashed on the Portal server and in the event log "A process serving application pool 'PortalWebSite' suffered a fatal communication error with the Windows Process Activation Service." error is reported for w3wp.exe process.
• Sometimes device is not registered and the "RM failed to register. Server not found server:<FQDN>" error is reported in the UEM troubleshooting logs.
• 503 services unavailable error when starting remote session from UEM console.

Possible cause

More log files are available in the Assist Anchor logs folder or ensure any antivirus software configuration is not causing new IIS AppPool creation.

Solution

Empty the Anchor logs folder and restart IIS AppPool - PortalWebSite and IIS website - Portal Web Site.

or

Set the value to True for Enable 32-bit applications option in the App Pool advanced settings for PortalWebSite.

Restart IIS website - Portal Web Site and IIS AppPool - PortalWebSite.

Problem

The error 'Invalid Operations Credentials' was observed during Portal service installation.

Possible cause

Token Service [moduleid: 16399] is in Fault state [status: 9]

• Check the following service record status on the database. It must be in the active state [4].
  • ApAdmin → dbo.Services → Token Service status
• Ensure the Token Service parameters are available in the Default Service configuration.
  • Apadmin → DefaultServiceConfiguration table → Verify the 16399 module parameters.

Solution

1. Remove the following record from the database.

   Apadmin -> Version table -> Delete the version number 3 record.

   DELETE from ApAdmin.dbo.[Version] where [Version] = '3'

2. Re-run the Workspace ONE Assist installer.

Problem

The error 'CertNotAvailable' was observed during the upgrade of the Assist service installation.

Possible cause

Windows display language is set to a language other than English or Windows OS is installed with the native language.

Solution

1. Update the English language as the Windows display language.
2. Sign out and sign in again on the system.
3. Re-run the Workspace ONE Assist installer.
4. Change the Windows display language again to the old [native] language once the installation is successful.
5. Verify the remote connections.

Remote Session Issues - Active Directory Accounts

Problems

1. 'Unable to connect to server' error is shown when access assist console and IIS Application pool is stopped. The following error is reported in the Event logs.

   'The identity of application pool MgmtWebSite is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.'

2. 'Windows could not start the service on a local computer. Error 1069: The service did not start due to a logon failure' error shown when restarting the assist services.

Possible Cause

Passwords for the assist service user are expired if Windows or Domain authenticated users are used to configure the assist services.

Solution

Reset the configured assist service user's passwords with the Assist Service User Configurations Utility tool. For information about resetting the passwords, see <a href = https://docs.omnissa.com/bundle/Workspace-ONE-AssistV23.07/page/InstallWorkspaceONEAssisttoanOn-PremisesEnvironment.html#update_service_users_password_with_assist_service_user_configurations_utility>Update Service Users Password with Assist Service User Configurations Utility..