Assist link not available
Issue: Assist Link is not showing in UEM Console under ‘More Actions’ pull-down menu
Cause: Device did not properly register and indicate to UEM Console that it registered with Assist
Solution: Ensure Assist agent is properly downloaded and installed on device. Ensure proper parameters are sent to device and/or Hub app has proper parameters and/or scripts.
Registration Failed/Server Not Found
Issue: Device does not register with UEM Console or RM portal. In the Troubleshooting screen, error message ‘Registration failed: Server not found’
Cause: When Assist agent gets pushed to the device it does not contain the correct registration information, such as URLs for the Assist server
Solution: In the UEM Console global settings ensure that the URLs for Assist server and client settings are correctly defined to be pushed down to the device
Network Firewall/Load Balancer/Proxy
Cause: Network firewall, proxy, or load balancer block connections to the Assist server
Solution: Ensure that there are exceptions on the network firewall or proxy allowing connections from devices and UEM Console to the Assist server. If there is a load balancer in front of the Assist server, ensure that the registration requests from the device can reach the load balancer on port 443 and are forwarded to the Portal (Anchor) service on the Assist server
Assist Server Firewall
Cause: Assist server firewall is ON and/or misconfigured. If the firewall is incorrectly configured on the Assist server it may be preventing device registration from coming to the server.
Solution: Turn off firewall or set up exceptions. When the firewall is on or it is not correctly configured, it may be preventing device registrations. Devices register with the portal service (Anchor), usually hosted on port 80 and 443 on the Assist server. If this port is blocked on the firewall, registrations will not happen. To fix this, turn off the firewall and attempt to re-register the device. If device registers, check the exceptions to ensure that the Anchor service typically on port 80 and 443, is in the list of exceptions.
Check Device Registration Failed
Issue: Checking Device Registration Fails when Assist link is clicked
SCHANNEL Security Provider Registry Key
Cause: During installation, the Assist Installer did not have proper permissions to add a registry key for SCHANNEL security providers.
Solution: Open registry editor on the RM server and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
Add the following registry key:
Value name: ClientAuthTrustMode
Value type: REG_DWORD
Value data: 2
NOTE: this solution is only necessary if the Checking Device Registration fails the first time you select Assist and it is a ONE-TIME fix. There is NO need to check this registry key again if the registration check fails.
T10 API Certificate Mismatch
Cause: UEM Console T10 API certificate has not been deployed properly on the Assist server and/or certificate table in the AirWatch DB.
Solution: Check the T10 logs on the Assist server (T10 logs are typically located in C:\Program Files\VMware\WorkspaceONEAssist\logs\Admin\T10). You may not find the UDID of the device in the T10 log file OR the T10 log file may be missing. Check the root IIS logs (Root IIS logs are typically in C:\inetpub\logs). You should see a request from the IP address of the AW Portal server to the ‘/T10’ service of the RM server with a 403 error. You will need to check the intermediate and root certificates on RM server corresponding to the certificates in the AW database. They may be mismatched. If you do not see entries in the IIS logs for ‘/T10’ it is possible that SSL traffic is not reaching the RM server. Please see next possible cause and solution ‘T10 traffic not reaching RM server’
T10 traffic terminated at Load Balancer
Possible Cause: T10 traffic not reaching Assist server
Solution: When the T10 traffic is not reaching the Assist server and the Assist server is behind a load balancer, it is possible that the load balancer is offloading SSL traffic for portal services but there is no exception for /T10 interface traffic on the load balancer. Check the load balancer configuration and ensure that there is an exception for T10 traffic. T10 SSL traffic must be terminated at the server for T10 interface. It cannot be offloaded at the load balancer.
Issue: Remote Session fails to connect during the connection steps and Request Timeout error or Link Activation message is seen
Possible Causes on Assist server
- One or more Windows service(s) not communicating with database or may not be running
- Connection Proctor Certificate may be misconfigured
- Network port for Connection Proctor service may not be opened/forwarded correctly
- Connection Proctor service is not running and/or Management Entity not seeing CP service
Solutions on Assist server
- Ensure Windows services are running and have started properly, correct Service Coordinator configuration if there are issues communicating with database
- Check Connection Proctor logs for certificate configuration
- Check network ports and ensure correct ports are configured for the service (443/8443)
- Check Management Entity Logs to see if Connection Proctor service is seen. Correct CP Service configuration and restart both services
- Poor Wi-Fi or data connection
- Wi-Fi network restrictions
- Power-save mode is on
- 3rd party firewall blocking RM connection
- Maximum data limit is reached
- Samsung KNOX has not been accepted
- Assist agent and/or registration removed from device
- Root/Intermediate certificate public key pair not on device
- Ensure device has good Wi-Fi or data connection
- Ensure Wi-Fi network restrictions to Assist are removed/exceptions in place
- Turn off power-save mode
- Disable 3rd party firewall or set up an exception for Assist
- UEM Console user must check the data limits for the device and ensure that the limit has not been reached
- On Samsung with Android OS below 6.0 KNOX prompt must be accepted. This will only happen one time for RM on 1st connection
- Push the Assist agent to the device and ensure device is registered with Assist. May need to re-register device.
- Install root/intermediate public key pair on device
Connection Errors – Missing Stub
Issue: On Android devices with Android OS version lower than 5.1, the Remote Support session connection times out on step 2. In the troubleshooting screen in the AW portal, the following error message is shown: “Device Event Log Description: RM Capability (-2 – Remote Control Feature cannot be supported – Dependency Stub missing”
Issue: On Android devices with Android OS version 5.1 or higher, the Remote Support session is in View Only mode and displays “View Only” indicator on top right
Missing or Incorrect Stub
Cause: Device stub pushed to the device is incorrect or missing
Solution: Push the correct stub with appropriate permissions for this device
Clientpolicies.xml is misconfigured
Cause: Clientpolicies.xml does not have the correct package name defined
Solution: Clientpolicies.xml file needs to be updated in the RM SAS (admin web) portal to define correct package and stub.
PIN Screen being shown
Issue: PIN Screen is showing on Assist Console or device but it should not
Cause: Wrong Assist agent deployed to device and/or configuration for attended/unattended mode is incorrect.
Solution: Check AW resource portal and ensure proper Assist agent is installed on device and adjsust the configuration accordingly.
Image does not stream/incorrect skin
Issue: During a remote support session in the Assist portal the device shows a black screen and there is no device streaming, device is missing buttons, or wrong device is shown
Cause: Black screen is caused by incorrect platform signatures. Missing or different/default device shown means server is missing the correct profile/skin
Solution: Escalate to Assist team to obtain and provide correct platform signatures and/or update device profile/skin.
More Info available on VMware Docs