Control agent troubleshooting

Overview

Sometimes when you install idemeum control agent you might experience installation errors on certain machines. This typically happens when you do not have sufficient permissions to install idemeum agent, the idemeum service is blocked when starting, security software is interfering, etc. In order to help you diagnose these issues, we created diagnostic scripts to identify the root cause of the problem.

Service installation failure

You execute the agent install, and it fails with error 1603. Then you open idemeum_install.log and observe the following:

MSI (s) (E0:80) [08:16:56:573]: Product: Idemeum Desktop Client -- Error 1920. Service 'Idemeum Service' (IDMService.exe) failed to start. Verify that you have sufficient privileges to start system services.

This means idemeum service is not able to start successfully. Run this in PowerShell as Administrator.

Set-ExecutionPolicy RemoteSigned -Scope Process -Force; Invoke-WebRequest -Uri https://asset.idemeum.com/desktoplogin/idemeumServiceCheckUtility.ps1 -OutFile "idemeumServiceCheckUtility.ps1"; .\idemeumServiceCheckUtility.ps1

This is a healthy sample output from a functioning machine.

--- dotnet --list-runtimes ---
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.25 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.25 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
------------------------------

Registering DLL...
DLL registered successfully.
Starting service...
Service started successfully. Status: Running
Stopping service...

Overall diagnostic

To diagnose the general state of the machine and any other idemeum installation failures run the following in PowerShell as Administrator:

Set-ExecutionPolicy RemoteSigned -Scope Process -Force; Invoke-WebRequest -Uri https://asset.idemeum.com/desktoplogin/diagnostic.ps1 -OutFile "diagnostic.ps1"; .\diagnostic.ps1

Here is a healthy sample output:

=== Credential Provider Diagnostic ===
Target CLSID: {417C7858-EE65-42AD-9F11-5BA27FB1FF64}

=== Credential Provider Filters ===
Filter detected:
  CLSID : {DDC0EED2-ADBE-40b6-A217-EDE16A79A0DE}
  Name  : GenericFilter
  Note  : Benign / generic filter (ignored)

✔ No effective third-party Credential Provider Filters detected.

=== Idemeum Credential Provider Registration ===
✔ Credential Provider registry key exists.
✔ Credential Provider is not marked as disabled.

=== COM Registration Check ===
COM DLL path: IDMCP.dll
✔ COM DLL exists on disk.

=== All Registered Credential Providers ===
  CLSID : {1b283861-754f-4022-ad47-a5eaaa618894}
  Name  : Smartcard Reader Selection Provider

  CLSID : {1ee7337f-85ac-45e2-a23c-37c753209769}
  Name  : Smartcard WinRT Provider

  CLSID : {2135f72a-90b5-4ed3-a7f1-8bb705ac276a}
  Name  : PicturePasswordLogonProvider

  CLSID : {25CBB996-92ED-457e-B28C-4774084BD562}
  Name  : GenericProvider

  CLSID : {27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}
  Name  : TrustedSignal Credential Provider

  CLSID : {3dd6bec0-8193-4ffe-ae25-e08e39ea4063}
  Name  : NPProvider

  CLSID : {417C7858-EE65-42AD-9F11-5BA27FB1FF64}
  Name  : IDMCP

  CLSID : {48B4E58D-2791-456C-9091-D524C6C706F2}
  Name  : Secondary Authentication Factor Credential Provider

  CLSID : {600e7adb-da3e-41a4-9225-3c0399e88c0c}
  Name  : CngCredUICredentialProvider

  CLSID : {60b78e88-ead8-445c-9cfd-0b87f74ea6cd}
  Name  : PasswordProvider

  CLSID : {8FD7E19C-3BF7-489B-A72C-846AB3678C96}
  Name  : Smartcard Credential Provider

  CLSID : {94596c7e-3744-41ce-893e-bbf09122f76a}
  Name  : Smartcard Pin Provider

  CLSID : {BEC09223-B018-416D-A0AC-523971B639F5}
  Name  : WinBio Credential Provider

  CLSID : {C5D7540A-CD51-453B-B22B-05305BA03F07}
  Name  : Cloud Experience Credential Provider

  CLSID : {cb82ea12-9f71-446d-89e1-8d0924e1256e}
  Name  : PINLogonProvider

  CLSID : {D6886603-9D2F-4EB2-B667-1971041FA96B}
  Name  : NGC Credential Provider

  CLSID : {e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}
  Name  : CertCredProvider

  CLSID : {F8A0B131-5F68-486c-8040-7E8FC3C85BB6}
  Name  : WLIDCredentialProvider

  CLSID : {F8A1793B-7873-4046-B2A7-1F318747F427}
  Name  : FIDO Credential Provider


=== Diagnostic Summary ===
✔ Credential Provider is correctly installed.
✔ No effective filter-based suppression detected.

=== UAC Settings (Readable) ===
EnableLUA                       : 1    (Enabled)
ConsentPromptBehaviorAdmin      : 0    (Elevate without prompting)
ConsentPromptBehaviorUser       : 3    (Prompt for credentials)
PromptOnSecureDesktop           : 1    (Enabled)
FilterAdministratorToken        :      (Not set)
EnableInstallerDetection        : 1    (Enabled)
EnableSecureUIAPaths            : 1    (Enabled)
ValidateAdminCodeSignatures     : 0    (Disabled)

=== End of Diagnostic ===

Endpoint control overview

Control agent

User management

AI for Endpoint Control

Endpoint Privilege Management

Allowlisting

Application trust

Just-in-time admin access

Portals

Control agent troubleshooting

Overview

Service installation failure

Overall diagnostic

​Overview

​Service installation failure

​Overall diagnostic

Overview

Service installation failure

Overall diagnostic