RSA Authentication Agent for Windows: Slow Login and WPI Failure When TCP Port 5580 Is Blocked
Originally Published: 2014-02-24
Article Number
Applies To
RSA Product/Service Type: Authentication Agent
RSA Version/Condition: 7.3.3, 7.4.2, 7.4.3
Issue
fter entering a passcode through the RSA Authentication Agent for Windows, the Windows desktop takes up to five minutes to appear. Windows Password Integration (WPI) does not complete successfully.
Observable symptoms:
- Login is very slow — the Windows desktop does not appear for several minutes after passcode entry.
- If Windows Password is not enabled, the user is prompted for their Windows password — but login still stalls.
- The logon session may timeout and return the user to the passcode prompt.
- Windows Password Integration (WPI) does not populate the Windows password automatically.
Key errors found in agent logs (when verbose logging is enabled):
In
C:\ProgramData\RSA\LogFiles\SIDCredentialProvider (LogonUI).log:[E] [CredentialProviderFilterPolicy::buildFilterPolicyMap] Error trying to obtain subkeys
[E] [AuthMechWrapper::authenticate] AuthMech getDomCredential failed to retrieve size: 0x17
[E] [AuthMechWrapper::authenticate] AuthMech authenticate failed: 0x8
In
C:\ProgramData\RSA\LogFiles\SIDAuthenticator (LoginUI).log:[E] [CommonAuthenticator::isAutoRegistrationServiceInstalled] Unable to open auto registration service: error = 0x424
[E] [CommonAuthenticator::setWindowsPassword] AceSetLogonPW failed: aceRet = 0x7d3In
C:\ProgramData\RSA\LogFiles\DAService (da_svc).log:DASvcDpsLink::establishConnection ( dpsPort=5580, dpsAddress=<AM-server-IP> ) starts.
DASvcDpsLink::isConnected there is no connection returning false
DaSvcAPIFactory::exception: Read timeout/failure. DASvcApiLink::serverExchange receive failed. (2003)
ℹ️ NOTE: Full log excerpts have been omitted for brevity. If you require the complete log output for troubleshooting, contact RSA Support.
Cause
The Windows agent's Offline Authentication service is attempting to reach the Authentication Manager server on TCP port 5580, but the connection fails — either because the port is blocked or because Offline Authentication is not enabled on the server.
When the local Offline Authentication service is running on the Windows agent but cannot communicate with the Authentication Manager server, the agent waits for a timeout (up to five minutes) before proceeding. This also prevents Windows Password Integration (WPI) from functioning, as WPI depends on the Offline Authentication service to retrieve and cache the Windows password.
This commonly occurs when TCP port 5580 is not open in the firewall between the agent and the server, or when the Authentication Manager server's Offline Authentication policy has not been enabled — even though the local service on the agent is active.
Resolution
Follow the path below that matches your situation.
Path 1: TCP Port 5580 Is Blocked
Step 1: Confirm that TCP port 5580 is open between the Windows agent machine and the Authentication Manager server. Work with your network team to unblock this port if it is currently restricted.
Step 2: Install the latest RSA Authentication Agent 7.3.3 build 99 (2018 or later) if not already installed.
✅ Expected result: After opening port 5580 and updating the agent, login time should reduce to approximately 30 seconds.
Path 2: Offline Authentication Is Not Enabled on Authentication Manager
Step 1: Log in to the RSA Authentication Manager Security Console.
Step 2: Navigate to Authentication > Policies > Offline Policy.
Step 3: Enable Offline Authentication in the policy settings.
Step 4: Save the policy changes.
✅ Expected result: The Windows agent's Offline Authentication service can now communicate with the server. Login time returns to normal and WPI begins functioning.
Path 3: Windows Password Integration (WPI) Is Not Working
ℹ️ NOTE: WPI requires both Offline Authentication and Windows Password Integration to be enabled on the Authentication Manager server. Completing Path 2 above is a prerequisite.
Step 1: Log in to the RSA Authentication Manager Security Console.
Step 2: Navigate to Authentication > Policies > Offline Policy.
Step 3: Confirm Offline Authentication is enabled (see Path 2).
Step 4: Enable Windows Password Integration in the same policy.
Step 5: Save the policy changes.
✅ Expected result: WPI is now active. After the next successful login, the Windows password is automatically populated for the user.
Workaround
⚠️ CAUTION: This is a temporary workaround only. It stops the login delay by preventing the agent from attempting to contact the Authentication Manager server on port 5580. However, it disables Windows Password Integration (WPI) and Offline Authentication entirely — users will no longer benefit from these features until the root cause is resolved and the services are re-enabled.
Step 1: Log in to the RSA Authentication Manager Security Console.
Step 2: Navigate to Authentication > Policies > Offline Policy.
Step 3: Disable Windows Password Integration in the policy settings.
Step 4: Set Offline Days to 0 to disable offline authentication caching.
Step 5: On the Windows agent machine, stop the RSA Offline Authentication local service:
- Open Services (
services.msc). - Locate RSA Offline Authentication.
- Right-click and select Stop.
- Set the Startup type to Disabled.
✅ Expected result: Login time returns to normal. The agent will no longer attempt to contact the server on port 5580.
ℹ️ NOTE: Once the root cause has been resolved (port 5580 opened or Offline Authentication enabled on the server), reverse these steps and re-enable Offline Authentication and WPI using the Resolution paths above.
Notes
