Common Issues

Assist link not available

Issue: Assist Link is not showing in UEM Console under ‘More Actions’ pull-down menu

Cause: Device did not properly register and indicate to UEM Console that it registered with Assist

Solution: Ensure Assist agent is properly downloaded and installed on device. Ensure proper parameters are sent to device and/or Hub app has proper parameters and/or scripts.

Registration Failed/Server Not Found

Issue: Device does not register with UEM Console or RM portal. In the Troubleshooting screen, error message ‘Registration failed: Server not found’

Wrong URL

Cause: When Assist agent gets pushed to the device it does not contain the correct registration information, such as URLs for the Assist server

Solution: In the UEM Console global settings ensure that the URLs for Assist server and client settings are correctly defined to be pushed down to the device

Network Firewall/Load Balancer/Proxy

Cause: Network firewall, proxy, or load balancer block connections to the Assist server

Solution: Ensure that there are exceptions on the network firewall or proxy allowing connections from devices and UEM Console to the Assist server. If there is a load balancer in front of the Assist server, ensure that the registration requests from the device can reach the load balancer on port 443 and are forwarded to the Portal (Anchor) service on the Assist server

Assist Server Firewall

Cause: Assist server firewall is ON and/or misconfigured. If the firewall is incorrectly configured on the Assist server it may be preventing device registration from coming to the server.

Solution: Turn off firewall or set up exceptions. When the firewall is on or it is not correctly configured, it may be preventing device registrations. Devices register with the portal service (Anchor), usually hosted on port 80 and 443 on the Assist server. If this port is blocked on the firewall, registrations will not happen. To fix this, turn off the firewall and attempt to re-register the device. If device registers, check the exceptions to ensure that the Anchor service typically on port 80 and 443, is in the list of exceptions.

Check Device Registration Failed

Issue: Checking Device Registration Fails when Assist link is clicked

SCHANNEL Security Provider Registry Key

Cause: During installation, the Assist Installer did not have proper permissions to add a registry key for SCHANNEL security providers.

Solution: Open registry editor on the RM server and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Add the following registry key:

Value name: ClientAuthTrustMode

Value type: REG_DWORD

Value data: 2

NOTE: this solution is only necessary if the Checking Device Registration fails the first time you select Assist and it is a ONE-TIME fix. There is NO need to check this registry key again if the registration check fails.

T10 API Certificate Mismatch

Cause: UEM Console T10 API certificate has not been deployed properly on the Assist server and/or certificate table in the AirWatch DB.

Solution: Check the T10 logs on the Assist server (T10 logs are typically located in C:\Program Files\VMware\WorkspaceONEAssist\logs\Admin\T10). You may not find the UDID of the device in the T10 log file OR the T10 log file may be missing. Check the root IIS logs (Root IIS logs are typically in C:\inetpub\logs). You should see a request from the IP address of the AW Portal server to the ‘/T10’ service of the RM server with a 403 error. You will need to check the intermediate and root certificates on RM server corresponding to the certificates in the AW database. They may be mismatched. If you do not see entries in the IIS logs for ‘/T10’ it is possible that SSL traffic is not reaching the RM server. Please see next possible cause and solution ‘T10 traffic not reaching RM server’

T10 traffic terminated at Load Balancer

Possible Cause: T10 traffic not reaching Assist server

Solution: When the T10 traffic is not reaching the Assist server and the Assist server is behind a load balancer, it is possible that the load balancer is offloading SSL traffic for portal services but there is no exception for /T10 interface traffic on the load balancer. Check the load balancer configuration and ensure that there is an exception for T10 traffic. T10 SSL traffic must be terminated at the server for T10 interface. It cannot be offloaded at the load balancer.

Connection Errors

Issue: Remote Session fails to connect during the connection steps and Request Timeout error or Link Activation message is seen

Possible Causes on Assist server

One or more Windows service(s) not communicating with database or may not be running
Connection Proctor Certificate may be misconfigured
Network port for Connection Proctor service may not be opened/forwarded correctly
Connection Proctor service is not running and/or Management Entity not seeing CP service

Solutions on Assist server

Ensure Windows services are running and have started properly, correct Service Coordinator configuration if there are issues communicating with database
Check Connection Proctor logs for certificate configuration
Check network ports and ensure correct ports are configured for the service (443/8443)
Check Management Entity Logs to see if Connection Proctor service is seen. Correct CP Service configuration and restart both services

Device-side causes

Poor Wi-Fi or data connection
Wi-Fi network restrictions
Power-save mode is on
3rd party firewall blocking RM connection
Maximum data limit is reached
Samsung KNOX has not been accepted
Assist agent and/or registration removed from device
Root/Intermediate certificate public key pair not on device

Device-side solutions

Ensure device has good Wi-Fi or data connection
Ensure Wi-Fi network restrictions to Assist are removed/exceptions in place
Turn off power-save mode
Disable 3rd party firewall or set up an exception for Assist
UEM Console user must check the data limits for the device and ensure that the limit has not been reached
On Samsung with Android OS below 6.0 KNOX prompt must be accepted. This will only happen one time for RM on 1st connection
Push the Assist agent to the device and ensure device is registered with Assist. May need to re-register device.
Install root/intermediate public key pair on device

Connection Errors – Missing Stub

Issue: On Android devices with Android OS version lower than 5.1, the Remote Support session connection times out on step 2. In the troubleshooting screen in the AW portal, the following error message is shown: “Device Event Log Description: RM Capability (-2 – Remote Control Feature cannot be supported – Dependency Stub missing”

Issue: On Android devices with Android OS version 5.1 or higher, the Remote Support session is in View Only mode and displays “View Only” indicator on top right

Missing or Incorrect Stub

Cause: Device stub pushed to the device is incorrect or missing

Solution: Push the correct stub with appropriate permissions for this device

Clientpolicies.xml is misconfigured

Cause: Clientpolicies.xml does not have the correct package name defined

Solution: Clientpolicies.xml file needs to be updated in the RM SAS (admin web) portal to define correct package and stub.

PIN Screen being shown

Issue: PIN Screen is showing on Assist Console or device but it should not

Cause: Wrong Assist agent deployed to device and/or configuration for attended/unattended mode is incorrect.

Solution: Check AW resource portal and ensure proper Assist agent is installed on device and adjsust the configuration accordingly.

Image does not stream/incorrect skin

Issue: During a remote support session in the Assist portal the device shows a black screen and there is no device streaming, device is missing buttons, or wrong device is shown

Cause: Black screen is caused by incorrect platform signatures. Missing or different/default device shown means server is missing the correct profile/skin

Solution: Escalate to Assist team to obtain and provide correct platform signatures and/or update device profile/skin.

More Info available on VMware Docs