Troubleshooting

Applies to client 2.0.x and later. For tenant admins, approvers, auditors.

Start with the facts: the user’s message shows a reason code and a request id under details, the same request id is in the portal’s Audit and in the device’s Windows Application log (source AdminExplorer), and the tray’s Status shows license, approval mode, enrollment and the last sync.

Common reason codes

Code	Meaning	What to do
`NoRule`	Not on the approved list and no rule matched	Add an approved entry or rule; rules need Enterprise
`DeniedPath`	The file is in a denied folder (Downloads, Temp, or your own pattern)	Move the file to an approved location, or change your denied paths
`HashMismatch`	The file is not the approved version	Update the SHA-256 in the entry
`HashFailed`	The file could not be read completely	Check the file and its permissions
`UnknownKind`	Not an `.exe`, `.ps1` or `.msi`
`BadArguments`	Arguments not allowed for this file type (for `.msi` only display and restart switches)
`ReasonRequired`	No reason or too short	The user types a longer reason
`UserWritableDir`	“Any application” match on a file the user controls	Install the program properly, or approve it explicitly
`ConsentCancelled`, `ConsentBusy`	The confirmation prompt was cancelled, timed out, or another one was open	Try again and confirm
`PolicyChanged`, `AnyDisabled`, `GroupChanged`	The policy, license or group membership changed before the start	Request again
`Rejected`, `Expired`	The approver rejected it, or nobody decided in time
`ApprovalBackendUnavailable`	Manual approval on a device that is not enrolled	Enroll the device
`TargetChanged`, `SessionGone`	The file changed, or the user signed out, before an approved start	Request again
`TooManyRequests`	Too many open requests for this user or device	Wait for the open ones to be decided or expire
`Unlicensed`	No valid license on the device	Check Licenses; renewals reach devices automatically
`Unc`, `RemoteDrive`, `RemovableDrive`, `SubstDrive`	Network path, network drive, removable drive or a mapped drive letter	Copy the file to a local folder
`ReparsePoint`, `ParentReparsePoint`	A link or junction in the path	Use the real path
`TooLarge`	The file is larger than 1 GiB
`EngineUnavailable`	The elevation driver is not available	Check event 1011 and the installation
`SandboxDisabled`, `SandboxNotTargeted`, `SandboxBusy`, `SandboxRestartPending`, `SandboxFeatureOff`, `SandboxUnsupported`, `SandboxNoVirtualization`	Run in sandbox is off, not for this user, already open, needs a restart, or not possible on this device	See Run in sandbox

New codes may appear in later versions; treat an unknown code as a denial and look it up in the audit record.

Event ids on the device

Windows Application log, source AdminExplorer. Every request event starts with requestId=.

Id	Level	Meaning
1010	Information	On-demand launch succeeded
1011	Information	Service ready (tier, approval mode, rule counts, engine state)
1012	Information	Elevated process ended, with duration
1013	Information	Request pending approval
1014	Information	License loaded
1015	Information	Enrolled in the portal
1016	Information	Portal policy applied (also: a restart is scheduled to apply approved-list changes)
1017	Information	License from the portal verified and stored
1018	Information	Audit records sent
1019	Information	Sync now served
1020, 1021	Information	Confirmation prompt started, and its answer
1022	Information	Installed software change
1025, 1026	Information	Sandbox started, sandbox ended
1027	Information	Windows Sandbox feature or its policy values changed (restart needed)
2004	Warning	Request denied, with the reason code
2005	Warning	Request refused: unlicensed
2006	Warning	Caller refused (identity, session or integrity)
2007	Warning	A setting, rule or denied path ignored as malformed
2008, 2009	Warning	Pending request expired, rejected
2010	Warning	Broad approved path or broad path rule
2011	Warning	Approved entry off the system drive without a SHA-256
2012, 2013	Warning	License expires soon, license in its 14-day grace period
2014	Warning	Portal unreachable or refusing (at most once per hour)
2015	Warning	Enrollment waiting for approval in the portal
2016	Warning	Portal policy rejected or not applied; the previous one stays
2017	Warning	Local audit queue full, oldest records dropped
2020	Warning	Untrusted sandbox folder on the device
3004	Error	A background operation failed (for example a sandbox or feature change)
3011	Error	Unlicensed, with the reason
3013	Error	Launch failed after a positive decision
3014	Error	The service could not open its request channel
3015	Error	Enrollment or configuration failed, with a code
3016	Error	Device revoked in the portal

The tray’s left-click menu lists approved entries that:

are enabled and have Show in the AdminExplorer menu on;
point to one .exe, .ps1 or .msi file (a folder path works for pre-approved starts but is never listed);
are not assigned to Entra groups the user is not a member of.

Also check:

The device has the current policy: Devices shows “current”, or press Sync now in the tray’s Status.
The menu category: the entry may be in a submenu such as Tools.
An entry with the same name created locally on the device wins over the portal’s; the portal entry is skipped.
The menu is refreshed when it opens and cached for 30 seconds.

Approved-list changes reach the pre-approved (automatic) flow at the next service restart, which the device schedules when it is idle, at the latest at 03:00 local time; Sync now applies them at once.

Device not enrolling

Symptom	Check
Nothing in the portal and no portal events on the device	The install did not get the transform: reinstall with `TRANSFORMS=` and the bundle’s `.mst`
Event 3015 `EnrollmentRefused`	The enrollment key is unknown, revoked, used up or expired (a new bundle revokes the previous key). Build a new bundle and repair the installation with its transform
Event 3015 `BadConfiguration`	The portal address or tenant id in the installation is wrong
Event 2015, device listed under Re-enrollments waiting for approval	The machine was enrolled before. Approve it on Devices (the old record is revoked)
Event 2014 every hour	A proxy, firewall or TLS inspection blocks the portal. The service runs as LocalSystem and uses the machine proxy settings (WPAD or `netsh winhttp`)
Event 3016	The device was revoked. Install a new enrollment key (a repair with a new bundle) to enroll it again
Event 2016	The portal policy has an entry the device refuses; fix the named entry. The device keeps its previous policy meanwhile

Sync now

Sync now is in the tray’s Status dialog and in the tray menu. It asks the service to do at once what it otherwise does on its timers: pull the policy, refresh the license, send audit records and software changes, reload the local rules and apply approved-list changes. The result line names each part, for example “Synced: policy unchanged, license unchanged, 2 audit records sent, local rules reloaded.”

At most once every 30 seconds per session; earlier presses say when to try again.
“Not enrolled” means the device has no portal connection; the local reload still ran.
A partial failure names the failed part, and the device keeps the previous policy and license.
With Entra group targeting on, it also refreshes the user’s group membership.

A program needs administrator rights from inside another

A program started elevated cannot start a child that demands administrator rights through its manifest. Approve that program on its own, or on Enterprise allow child elevation on the parent entry or rule.

AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.