This page is for administrators and helpdesk staff. Start with the health check, then find the symptom in the tables. Each fix links to the page that describes it in full. If nobody can sign in, follow the recovery procedure in the Fleet documentation in the downloads portal (login required).
From an elevated prompt run mideye cp health (--json for the machine-readable form). It prints the protection state, the service, the backend, the break-glass accounts and any problem. In Mideye Configuration, Overview shows the same, and Diagnostics has Run health check and More checks….
| Check | Means |
|---|
| Broker | The MideyeBroker service is running and answers. |
| Backend | The computer can reach Mideye Cloud or a Mideye Server and the credentials work. |
| Credential provider | The provider and filter are registered and healthy. |
| Remote Desktop MFA | Remote Desktop is protected. Event 5503 means it is not. |
| Break-glass | The break-glass accounts were found on this computer. |
Event 1001 (sign-in denied) carries the reason. Where the logs and events are: Logs and events.
| Symptom | Cause | Fix |
|---|
| The Mideye tile does not show | Protection is not turned on. The tile is not shown until it is; Windows’ own sign-in is used until then. | Turn on protection. |
| The tile does not show after the install | Windows 11 was not restarted after the install. | Restart, as described in Install. |
| The tile does not show on a protected computer | A recovery override is active. | End it with mideye cp enable. The recovery procedure is in the Fleet documentation in the downloads portal (login required). |
| Other tiles are still shown | The computer is Armed, not Activated. Other tiles stay until the first Mideye sign-ins succeed. | See Rollout. |
| Protection fell back to Disarmed (event 5314) | Three sign-ins in a row failed while armed. | Fix the cause, then arm again. See Rollout. |
| MFA is not asked for one user | A user rule or a schedule hour does not need MFA. | Check Users and Schedule. |
MFA is not asked for runas, services or network sign-ins | Only interactive sign-ins meet the tile. | Expected. |
| Symptom | Cause | Fix |
|---|
| “The Mideye Server cannot be reached” | Network, certificate or credentials. Event 5810 names the cause (pin-mismatch, certificate-untrusted). | Press Test on the Connection page. |
| Event 5812 | A proxy wants a login. | See the network rules in Requirements. |
| Event 2010 or 2015 (Mideye Cloud) | Wrong client ID or secret, or the key has expired. | Create a new secret in the Mideye portal and enter it on the Connection page. |
| Event 2014 (Mideye Server) | The API token is rejected. | Set a valid API token on the Connection page. |
| A local account cannot sign in with Mideye Server | No database user with the same name, or Require password (first factor) is on. | See Connect Mideye Server. |
| Symptom | Cause | Fix |
|---|
| Touch never arrives | The user has no phone number (event 1005), the server cannot send Touch, or another request is still open. | Check the phone number in AD (mobile by default) or the Mideye Server. Wait a minute for an open request. |
| The tile asks for a code instead of Touch | Touch is off, the user’s rule is One-time code only, or Touch could not start (event 1005 or 1017). | Check Sign-in methods. |
| “Too many wrong codes.” | Five wrong one-time codes in 15 minutes block the user (event 1014). | Unblock on Diagnostics. |
| Authenticator app codes are refused | The phone clock is wrong, or the user enrolled elsewhere. | See Set up the authenticator app. |
| Assisted Login cannot start | No approver can confirm. Event 1001 names each approver left out and why. | Check the list on Approvers. |
| “Mideye Server: approver lookup is off. Contact your administrator.” | Enable approver lookup is off on the Authentication API endpoint (reason=OptionsLookupDisabled). | Turn it on. See Set up Assisted Login. |
| “Mideye Server: OTP approval is off. Contact your administrator.” | Enable OTP approval is off on the Authentication API endpoint (reason=OtpApprovalDisabled). | Turn it on. See Set up Assisted Login. |
| Symptom | Cause | Fix |
|---|
| The Remote Desktop session ends or times out | The RDP logon timeout is below 240 seconds. | Run mideye cp install-invariants. See Remote Desktop. |
| The configuration does not apply | The document has an error, or the service has not loaded it yet (about a minute). | Look at Problems and changes. |
| A hand edit is reverted (event 6071) | The computer is managed by Fleet. | Change the policy in Fleet. See Fleet page. |
| Event 1116 | A Group Policy configuration file was refused. The last good configuration stays. | Correct the Group Policy configuration file. |
| The installer refuses (event 1112) | A pre-check failed. | Read event 1112. It names the check that failed. |
| Uninstall stops with error 1603 | Mideye protects itself while it is on. | See Upgrade and uninstall. |
