[WCP] Component buckets empty, ak_sys_auth_interactive_available exception despite valid enrollment

[derever]

Hi,

we're trying to get the WCP running on a Windows 11 machine (domain-joined, HP Z2 G5) with agent 0.40.1 and server 2026.2.0.

Enrollment works fine, config gets pulled correctly (license_status=valid, authorization_flow set, JWKS keys present), and domains join succeeds with exit 0. But the component buckets (auth, ctrl, device, ping, session, agent_starter) in troubleshoot inspect are always empty.

Because of that, the credential provider DLL throws Exception in ak_sys_auth_interactive_available on every login screen load and the CEF login window never appears.

What we tried:

1. Fresh enrollment with new token
2. domains join as SYSTEM (exit 0, no errors)
3. Setting authorization_flow on the connector (was null initially)
4. icacls permissions on the WCP directory ([WCP] CEF window does not show up when wcp is installed in Program Files #440 workaround)
5. Restarting the agent after each change

troubleshoot check shows the expected NSS/PAM failures (Linux-only) and unknown service sys_directory.SystemDirectory via gRPC, but the agent itself is running fine.

The agent config in the DB looks correct, it just seems like the components never actually start. Any idea what we might be missing, or is this still WIP?

Thanks!

[BeryJu]

Could you provide the logs for the ak-sysd service?

[derever]

Here are the ak-sysd logs from the Windows Event Log (authentik, debug mode enabled).

Environment: Agent 0.40.1-3148069b, Windows 10 Pro 22H2 (Build 22621.5624), HP Z2 Tower G5 Workstation

Recurring warning (~every 30 min) - device checkin fails:

2026-03-03T15:36:38 level=info  msg="Starting checkin" domain=ak-mdm-managed logger=component.device target="authentik System Service"
2026-03-03T15:36:38 level=debug msg="fetched remote config" cap="[can_asn can_geo_ip can_impersonate is_enterprise]" device_id=8e0a27f5-928c-4709-a53a-79f0f7c780ee logger=storage.config
2026-03-03T15:36:56 level=debug msg="Starting facts gathering..." logger=component.device target="authentik System Service"
2026-03-03T15:36:56 level=debug msg=Gathering... area=disk
2026-03-03T15:36:56 level=debug msg=Gathering... area=hardware
2026-03-03T15:36:57 level=debug msg=Gathering... area=network
2026-03-03T15:36:57 level=debug msg=Gathering... area=os
2026-03-03T15:36:57 level=warning msg="failed to checkin" error="failed to gather device info: The system cannot find the file specified." logger=component.device target="authentik System Service"

This repeats every checkin cycle. Config fetch works, but facts.Gather() fails somewhere in the disk/hardware/network/os chain.

ak version shows broken agent pipe:

authentik Agent CLI: 0.40.1-3148069b
Agent: rpc error: code = Unavailable desc = connection error: desc = "transport: failed to write client preface: The pipe has been ended."
System: 0.40.1-3148069b

Credential provider log after a fresh login attempt today:

[2026-03-03 16:30:47.319] [ak_cred_provider] [info] [ak_log.cpp:33] authentik Platform ak_cred_provider Version 0.40.1

No exception this time, but also no CEF window. The credential provider loads, then nothing happens. On earlier attempts (Feb 27) it threw Exception in ak_sys_auth_interactive_available on every login screen load.

What we checked on the machine:

• WMI repository is consistent (winmgmt /verifyrepository passes)
• WMI queries (Win32_ComputerSystem, Win32_BIOS, Win32_DiskDrive, Win32_EncryptableVolume) all work fine from PowerShell
• So the "file not found" error seems to be specific to how the Go code gathers facts, not a general WMI issue

Apart from the checkin failures, the rest of the log is healthy 30s ping/heartbeat cycles (all OK) and state transactions.