RSA Product Set: SecurID and ID Plus
RSA Product/Service Type: MFA Agent for Microsoft Windows
Version(s): All supported versions

This article summarizes steps that should be taken to troubleshoot the RSA MFA Agent.

Basic Troubleshooting

Advanced Troubleshooting

Basic Troubleshooting

Initial checks that can be done to troubleshoot before calling RSA Support:

• Check the list of common issues and solutions in the Installation and Administration Guide for your RSA MFA Agent version.  See section "Issues and Resolutions" in the "Troubleshooting" chapter.
• On the Windows computer that is encountering the issue, look for errors logged in the following location of Windows Event Viewer, around the date and time that the problem occurred:
  • Applications and Services Logs > RSA MFA Agent

If no recent events are logged, check in Windows services.msc that the RSA MFA Agent service is running.   The service must be running, and must be set to start automatically at startup.  If need be, start the RSA MFA Agent then check if the issue still occurs.

Advanced Troubleshooting

Do the steps below in the order shown to get the data that Support will need to troubleshoot.  Follow the links provided for detailed instructions. 

Include AM steps if the MFA Agent is connecting to RSA Authentication Manager, or is using AM as a secure proxy for the Cloud.

Include CAS steps if the MFA Agent is connecting to the RSA Cloud, or is using AM as a secure proxy for the Cloud.

1. Enable trace logging in GPO for the RSA MFA Agent.  For instructions, see chapter Troubleshooting, section "Enable Tracing" in the Installation and Administration Guide for your RSA MFA Agent version.  Make a note of the current configuration so you can change it back to that later.  Then, set the following:
   • Specify logging options: set to Enabled 
   • Log level:  must be set to Verbose . 
   • Components to Log:  tick all checkboxes
   • Path to to store log files:  make a note of the path. If nothing is specified, it will be C:\ProgramData\RSA\Log Files.
2. CAS: If the user is not receiving push notifications when expected, enable Enhanced Log Connection in the RSA Authenticator app.  See How to capture enhanced RSA Authenticator app logs for troubleshooting purposes  .
3. AM: Configure logging on all AM servers for Trace Log.  Make a note of the previous log level so it can be set back to that later.
4. Reproduce the issue or wait for it to occur.  Note the date, time (with timezone) and user id of the attempt.  Record video or take photos of unusual behaviour and errors.
5. AM:  set Trace Log back to its original log level on all AM servers.  Do not leave it at Verbose longer than necessary.  It will generate huge amounts of log data which can have adverse effects.
6. CAS: Disable Enhanced Log Connection in the RSA Authenticator app, if it was enabled.
7. Optionally, set the RSA MFA Agent logging back to its original settings in GPO.   See the Notes section at the end of this KB article.
8. Send to Support selected Logs & Reports from the table below, depending on the nature of the issue.  RSA Support will advise which ones to send.

If possible, leave trace logging enabled for the RSA MFA Agent until the issue has been remediated in case logs are needed for another instance of the problem.   The Number of Log Files and Size of Log Files settings (in the Specify Logging Options configuration in GPO Policy) will limit the amount of disk space that trace logging consumes.

Examples of important events recorded in Windows Event Viewer logs:

• Windows Logs > Application : install events for the RSA MFA Agent
• Windows Logs > Security : audit records of activities on the Windows computer
• Windows Logs > System : Windows startup events that confirm if and when the RSA MFA Agent service was started, and that of other services it depends on.  Errors from important Windows components such as SChannel.
• Applications and Services Logs > Microsoft > Windows > Crypto-DPAPI >  Operational : events related to Windows' encryption of offline data and other sensitive information saved on the local computer by the RSA MFA Agent. 
• Applications and Services Logs > RSA MFA Agent : day-to-day operational events recorded by the RSA MFA Agent.   These are documented in the RSA MFA Agent's Installation and Administration Guide , in "Chapter 5: Troubleshooting", section "Windows Event Messages Written by the MFA Agent".