| Description | This article describes that the agent failed to enroll. |
| Scope | FortiDLP. |
| Solution |
Accessing the enroll-on-installation.log file: If the agent is installed via the GUI on Windows and an enrollment code or bundle is used, an error may be presented saying to read the enroll-on-installation.log file:
If this file is not accessible via Windows Explorer, the best way to quickly view it is to open an Administrative PowerShell window and use:
Get-Content 'C:\ProgramData\Jazz Networks\Agent\logs\enroll-on-installation.log' <----- Generic.
This will print the enrollment log to the console and can be used to identify the following possible scenarios.
Expired Enrollment Token:
PS C:\Users\User> & 'C:\Program Files\Jazz Networks\Agent\agent.exe' enroll <enroll_code> <----- Generic. The agent is not enrolled (waiting for enrollment). Waiting for enrollment to complete... Error: enrollment failed: enrolling
Often seen when deploying new agents to an existing fleet where an enrollment token has expired.
Solution: The fix is simple, it is necessary to increase the expiration period. This can be done from the Admin -> Agent Deployment section. From here, it is necessary to find the Enrollment token that is being used, expand the dropdown, and modify the necessary values:
Enrollment Token Out Of Uses:
PS C:\Users\User> & 'C:\Program Files\Jazz Networks\Agent\agent.exe' enroll <enroll_code> <----- HTML. The agent is not enrolled (waiting for enrollment). Waiting for enrollment to complete... Error: enrollment failed: Unauthenticated
Often seen when deploying to an existing fleet where the number of uses assigned to the enrollment token has been used to completion.
Solution: The fix is simple, we need to add more uses to the token. This can be done from the Admin -> Agent Deployment section. From here, it is necessary to find the Enrollment Token that is being used, expand the dropdown, and modify the necessary values:
Unable To Reach The Cloud:
PS C:\Users\User> & 'C:\Program Files\Jazz Networks\Agent\agent.exe' enroll <enroll_code> <----- Generic. The agent is not enrolled (waiting for enrollment). Waiting for enrollment to complete... Error: gave up waiting for enrollment to complete
Often seen on fresh deployments, this issue is visible when there is another security product in place (redirect services or proxies) that interferes with the Reveal Agents' communication with the Reveal Cloud.
Solution: Make sure to add the appropriate Reveal URLS to the allow lists for these other security products. Alternatively, this error can also be seen when the host machine's system clock is off by an excessive amount. This occurs when the Reveal Cloud tries to validate certificates with the agent. The host machine needs to sync with an NTP server or have the system clock manually corrected. |
