Applies to client 2.0.x and later. For tenant admins, approvers and auditors.
The AdminExplorer service writes to the Windows Application log, source AdminExplorer. It writes no text log files. The id range gives the level: 1000s information, 2000s warnings and denials, 3000s errors, 5000 unexpected. Every event about a request starts with requestId=, the same id the user sees under details and the portal shows in Audit.
For the most common situations start with Troubleshooting.
| Id |
Meaning |
| 1000, 1001 |
Service starting, service running |
| 1002 |
Configuration loaded |
| 1003, 1004 |
Service stopping, service stopped |
| 1005, 1006 |
Service installed, service removed |
| 1007 |
Connected to the AdminExplorer driver |
| 1008 |
Pre-approved list sent to the driver |
| 1009 |
Pre-approved program started elevated in the user’s session |
| 1010 |
On-demand launch succeeded |
| 1011 |
Service ready for requests (tier, approval mode, rule counts, engine state); also “recovered” after 3014 |
| 1012 |
Elevated process ended, with exit code and duration (both flows) |
| 1013 |
Request pending approval |
| 1014 |
License loaded or changed |
| 1015 |
Enrolled in the portal |
| 1016 |
Portal policy applied (counts, changed settings, entries skipped because a local entry has the same name); also a scheduled restart to apply approved-list changes |
| 1017 |
License from the portal verified and stored |
| 1018 |
Audit records sent to the portal |
| 1019 |
Sync now served, with the result of each part |
| 1020, 1021 |
Secure-desktop confirmation prompt started, and its answer (allow, cancel, timeout, unavailable, busy) |
| 1022 |
Installed software change (installed, removed, updated), with the linked elevation when there is one |
| 1025, 1026 |
Sandbox started; sandbox ended (closed, time limit reached or service stopped), with the duration |
| 1027 |
Windows Sandbox feature turned on or off (restart needed), or its policy values set or removed |
| 1030 |
Member removed from a protected local group |
| 1031 |
Local administrator protection: mode or protected groups changed, or security group auditing turned on |
| Id |
Meaning |
| 2000 |
Configuration missing |
| 2001 |
Pre-approved list is empty |
| 2002 |
No active console session; a pre-approved start was skipped |
| 2003 |
A program caught by the driver did not match the pre-approved list |
| 2004 |
Request denied, with the reason code |
| 2005 |
Request refused: unlicensed |
| 2006 |
Caller refused (identity, session or integrity check) |
| 2007 |
A setting, rule, denied path or policy line ignored as malformed (the safe default applies) |
| 2008 |
Pending request expired |
| 2009 |
Pending request rejected by the approver |
| 2010 |
Broad pre-approved path (not ending in .exe or fewer than three backslashes) or a broad path rule such as C:\* |
| 2011 |
Approved entry off the system drive without a SHA-256 |
| 2012 |
License expires soon (once per day, from 14 days before) |
| 2013 |
License expired, in its 14-day grace period (once per day) |
| 2014 |
Portal unreachable or refusing (at most once per hour) |
| 2015 |
Enrollment waiting for approval in the portal |
| 2016 |
Portal policy refused or not applied; the previous one stays |
| 2017 |
Local audit or software change queue full, oldest records dropped |
| 2018 |
Software inventory state could not be read; a new baseline starts |
| 2020 |
Untrusted sandbox folder on the device; Run in sandbox refused until it is fixed |
| 2030 |
Member not allowed in a protected local group and not removed (report mode or held) |
| 2031 |
Security group auditing is off or the subscription failed; the device checks every 15 minutes instead |
| 2032 |
Repeat offender: a removed member was added back again |
| Id |
Meaning |
| 3000 |
Service installation or removal was started without administrator rights |
| 3001, 3002 |
Service installation or removal failed |
| 3004 |
A background operation failed (for example a sandbox start, a Windows feature change or the local audit queue) |
| 3005 |
The AdminExplorer driver is not available |
| 3006 |
The driver connection or version check failed; pre-approved starts are off until it is fixed (typically a restart after an update) |
| 3007 |
The pre-approved list could not be sent to the driver |
| 3008, 3009 |
A pre-approved start could not be elevated |
| 3010 |
The driver did not recognise this Windows build and stays off (fail closed); pre-approved starts are not elevated |
| 3011 |
Unlicensed, with the reason (also a license from the portal that the device refused) |
| 3012 |
Approved entry dropped: its path is not a valid local path |
| 3013 |
Launch failed after a positive decision, or a post-approval check failed (AnyDisabled, GroupChanged, TargetChanged) |
| 3014 |
The service could not open its request channel (retried automatically) |
| 3015 |
Enrollment or configuration failed, with a code (see below) |
| 3016 |
Device revoked in the portal |
| 3030 |
Removing a member from a protected group failed |
| 3031 |
Lock-out guard: nothing was removed from Administrators, because no administrator path would remain |
| 3032 |
The members of a protected group could not be read; nothing is removed from it |
| Id |
Meaning |
| 5000 |
Something that should not happen, for example a worker that did not stop within 25 seconds of a service stop. Report it to your provider with the event text. |
| Code |
Meaning |
What to do |
BadConfiguration |
The portal address or tenant id in the installation is wrong (the address must be https://) |
Reinstall or repair with the bundle’s transform |
EnrollmentKeyMissing, BadEnrollmentKey |
No usable enrollment key on the device |
Repair with a current bundle |
EnrollmentRefused |
The key is unknown, revoked, used up or expired (a new bundle revokes the previous key) |
Build a new bundle and repair with its transform |
EnrollmentRejected |
The portal rejected the enrollment |
Check the device under Devices |
TooManyPending |
Too many enrollments waiting for approval |
Approve or clear waiting re-enrollments |
TenantMismatch |
The answer belongs to another tenant |
Check the transform matches the tenant |
StateAclInvalid |
The protected enrollment state had wrong permissions and was deleted |
Repair with the transform to enroll again |
TokensUnreadable, TokensRefused |
The stored device tokens could not be read or were refused |
Repair with a new bundle |
BadResponse, StateWriteFailed, NoMachineId |
The answer could not be used, the state could not be stored, or the machine id could not be read |
Check the device; contact your provider if it persists |
A denied or refused request carries one reason code. It is shown to the user under details, written to event 2004 (or the event named) and stored in the audit record. New codes may appear in later versions; treat an unknown code as a denial and look it up in the audit record.
| Code |
Meaning |
What to do |
NoRule |
Not on the approved list and no rule matched |
Add an approved entry or a rule (rules need Enterprise) |
DeniedPath |
The file is in a denied folder (built-in or your own pattern) |
Move the file, or change your denied paths |
HashMismatch |
The file is not the approved version |
Update the SHA-256 in the entry |
HashFailed |
The file could not be read completely |
Check the file and its permissions |
UnknownKind |
Not an .exe, .ps1 or .msi (or a shortcut to one) |
|
BadArguments |
Arguments not allowed for this file type |
See arguments |
ReasonRequired |
No reason, or too short |
The user types a longer reason |
UserWritableDir |
“Any application” match on a file or folder the user controls |
Install the program properly, or approve it explicitly |
Unlicensed |
No valid license on the device (event 2005) |
Check Licenses; renewals reach devices automatically |
| Code |
Meaning |
ConsentCancelled |
The confirmation prompt was cancelled or timed out |
ConsentBusy |
Another confirmation prompt was already open in the session |
ConsentUnavailable |
No prompt was possible; the request went to an approver (a pending state, not a denial) |
Rejected |
The approver rejected the request |
Expired |
Nobody decided within the pending request lifetime |
PortalRefused |
The portal refused the approval request |
ApprovalBackendUnavailable |
Manual approval on a device that is not enrolled |
TooManyRequests |
Too many open requests for this user or device |
TargetChanged, SessionGone |
The file changed, or the user signed out, before an approved start |
PolicyChanged, AnyDisabled, GroupChanged |
The policy, the license or the group membership changed before the start; request again |
| Code |
Meaning |
Unc, RemoteDrive |
A network path or a network drive |
RemovableDrive, SubstDrive, UnsupportedDrive, VolumeMissing, VolumeQueryFailed |
Not a local fixed drive (removable, a SUBST or mapped letter, or a drive that could not be identified) |
ReparsePoint, ParentReparsePoint |
A symbolic link, junction or mount point in the file or a parent folder |
DevicePrefix, NtPrefix, ForwardSlash, StreamColon, NotDriveRooted, InvalidChar, ControlChar, Empty, TooLong, NoFileName |
The path is not a plain absolute X:\... path |
EmptyComponent, DotComponent, DotDotComponent, TrailingSpaceOrDot, ReservedName, ShortName |
A path component that is empty, . or .., ends in a space or dot, is a device name such as CON or NUL, or is an 8.3 short name |
OpenFailed, ImpersonationFailed, FileInfoFailed |
The file could not be opened or examined as the user |
NotRegularFile, FinalPathMismatch |
Not a regular file, or the path the file really has differs from the requested one |
TooLarge |
The file is larger than 1 GiB |
Copy the file to a local folder on the system drive and use its real path.
| Code |
Meaning |
EngineUnavailable |
The elevation driver is not available (see event 3005 or 3006) |
TrackerUnavailable |
The program could not be started after a positive decision (event 3013) |
BadRequest |
The request from the tray or right-click menu was malformed |
RateLimited |
Too many sandbox requests in a short time (at most 6 per minute per session) |
| Code |
Meaning |
SandboxDisabled |
Run in sandbox is off |
SandboxKind |
The file kind is not allowed in the sandbox |
SandboxNotTargeted |
The user is not in the groups Run in sandbox is limited to |
SandboxBusy |
A sandbox is already open in the session (also one opened outside AdminExplorer) |
SandboxRestartPending |
The Windows feature was changed and the device needs a restart |
SandboxFeatureOff |
The Windows Sandbox feature is off |
SandboxUnsupported |
The Windows edition has no Windows Sandbox (for example Home) |
SandboxNoVirtualization |
Hardware virtualization is not available |
SandboxFolderUntrusted |
The protected sandbox folder has wrong permissions or is a link (event 2020) |
SandboxFailed |
Windows Sandbox could not be started (event 3004) |
See Run in sandbox.