Troubleshooting
u2auth-admin check first, then what each message means, and how to get back in.
u2auth-admin check
PowerShell (Administrator)
u2auth-admin check # exits 1 if a sign-in can skip U2 Secured right nowRun it from an elevated PowerShell. Each line starts with ok, info, warn or FAIL, with a fix under anything that is not ok; it exits 1 if a sign-in can skip U2 Secured right now.
| Check | What it looks at |
|---|---|
provider | The U2 Secured sign-in tile is registered. FAIL: reinstall. |
filter | The filter that hides Windows’ own tiles is registered. FAIL: reinstall. |
group | Who is in “U2 Secured Users”. info when it is empty: nobody is asked for U2 yet. |
autologon | Automatic sign-in (AutoAdminLogon). FAIL if Windows signs a group member in by itself, which skips U2. |
hello | Windows Hello-only sign-in. FAIL when it is on: there is no password sign-in for U2 to protect. |
sealing | How secrets are sealed: TPM (ok), DPAPI (warn: a local administrator can unseal them), or nothing sealed while members exist (FAIL). |
sshd | The OpenSSH Server service. warn when running: sessions through it are not gated. |
winrm | The WinRM service. warn when running: remote sessions through it are not gated. |
What the messages mean
| You see | What to do |
|---|---|
| Windows’ own tiles (PIN, Windows Hello, a password tile without “U2 Secured”) are back | The sign-in hook is broken, usually because a file in Program Files\U2Secured is missing. Nobody is asked for U2 until you reinstall the MSI. |
| “U2 Secured needs a password for this account.” | The account has a blank password. Give it one (lusrmgr.msc, or net user from an administrator account). |
| “U2 Secured is unreachable — this computer may be offline.” | Type a code from the authenticator app or a backup code. If the PC is online, check that it can reach the U2 Secured service. |
| “U2 Secured: no answer from your phone.” | The push was not answered in time. Type a code, or sign in again and watch the phone. |
| “Code not accepted.” | Wrong, or already used. Wait for the next code. The third wrong code ends the attempt. |
| “U2 Secured did not approve this sign-in.” | Denied on the phone, the wrong number, or three wrong codes. Sign in again. |
| The code box closes by itself | Windows closes an idle sign-in screen after about a minute. Sign in again. |
| Reconnecting over Remote Desktop shows a Sign in button and no push | Click Sign in; the push follows. An automatic push on reconnect is planned. |
| Event 1100 (config_error or seal_error) | Every protected sign-in is refused. Read the err= part of the event and run u2auth-admin check. |
| Event 1101 (group lookup failed) | Windows could not read the group, so the person was let in without U2. Run u2auth-admin check. |
| A silent install fails with error 1603 | Read Event 1103 in the Application log: it gives the reason registration failed, for example an expired or used-up token. |
| Event 1103: MACHINE_NAME_TAKEN: name "reception-pc" is already used by another machine in this app | The PC is being installed again under a name the portal still lists. Revoke the old entry first (Machines → Revoke), or install with a new MACHINE_NAME. |
| The installer refuses: “… was created by another account (S-1-5-21-…); remove C:\ProgramData\U2Secured and run the installer again” | Something under C:\ProgramData\U2Secured is owned by an account that is not an administrator. A non-administrator could have planted settings there, such as a different service or failmode = safe, so the installer will not trust the folder. Check what is in it, delete the folder, and install again. |
| Everyone is refused at the sign-in screen, the emergency administrator too | Security software (AppLocker, WDAC, Smart App Control or antivirus) is blocking u2auth-pam-helper.exe, or it crashes on start. The U2 Secured tile then refuses every account and offers no other tile, so a password alone does not get in at the console. Get in remotely instead, over SSH, WinRM or your remote-management tool, and either allow-list Program Files\U2Secured\u2auth-pam-helper.exe in that software, or remove the sign-in hook with msiexec /x u2secured-windows-<version>-x64.msi /qn or u2auth-admin uninstall-hook. Whether Safe Mode gets you past it has not been tested. |
Someone is locked out
- 1Sign in as the emergency administrator. It is outside the group, so its password is enough.
- 2Take the person out of “U2 Secured Users”: they sign in on their password alone for now.
- 3Enrol them again (a new phone: reset with --unpair first), then add them back.
PowerShell (Administrator)
Remove-LocalGroupMember -Group "U2 Secured Users" -Member alice
u2auth-admin reset alice --unpair # a new phone: forget the old pairing and codes
u2auth-admin enroll alice --backup-codes 5
Add-LocalGroupMember -Group "U2 Secured Users" -Member aliceWithout an administrator outside the group, the only ways in are the person’s authenticator code and backup codes. That is why the emergency administrator matters.