Windows Local device login does not appear/login window never opens

[SaadBazaz]

Hey,

I'm not using an MDM, and trying to set up authentik for Windows login. However, after following all the steps in https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/windows/ (other than the "Enable SSH client authentication and CLI application authentication" , I'm not sure that's necessary), I still can't see the Authentik Login appear in the windows lock screen.

Am I missing something here?

[glennrice]

Same here. Although I did do the "Enable SSH client authentication and CLI application authentication" step. Not for the SSH auth but I thought the CLI bit may be necessary. Either way, the Authentik login option is not showing for me either.

I noticed the Credential Manager service wasn't running for some reason on the PC but no change after starting that, setting it to auto and reinstalling the agent.

What are we missing?

[BeryJu]

When everything is setup correctly for local auth on windows (including enrollment of the agent and enterprise on the authentik server), this is most likely caused by a race condition.

The WCP checks with sysd if interactive auth is available, however sometimes the sysd service is started too late and the WCP can't check with it. The workaround for this is to log in locally to a different user and then log back out.

#762 should fix this by saving the interactive auth available flag in the registry where the WCP can check it regardless.

[glennrice]

Yes, with the latest Authentik and agent version, the Authentik logon option appears now.

Clicking it never pops up the Authentik logon window but perhaps I have something wrong with the OpenID flow... I'll check that first. We're one step further though. ;-)

[BeryJu]

@glennrice the window not showing up is something we've been debugging, could you add which version you're running and the logs?

[glennrice]

Current versions:

• Authentik version 2026.2.2
• Agent 0.40.5 running on Windows 11

I have tried reinstalling the agent and went through the registration process again, rerunning ak-sysd.exe.
Does it matter what deployment_name is? I couldn't find a definite answer in the docs..

I see the following two errors in the event log on the Windows PC:

level=warning msg="failed to start agent" attempt=7 error="get duplicate user token for current user session: call native WTSQueryUserToken: An attempt was made to reference a token that does not exist." logger=component.agent_starter pid=6892 target="authentik System Service"

The token should be correct as I copy and pasted it again when I re-ran the ak-sysd command line.

level=warning msg="failed to fetch config" error="Get \"https://id.mydomain.net/api/v3/endpoints/agents/connectors/agent_config/\": dial tcp: lookup id.mydomain.net: no such host" logger=storage.config

Hope that helps. Happy to check/try anything else.

[BeryJu]

@glennrice can you re-try with the newly tagged version 0.40.6? I found an issue in the build pipeline that included an old build of the WCP instead of the latest one.

The error mentioning WTSQueryUserToken is not related to this, this is caused by the agentstarter component, which attempts to start the user agent (ak-agent.exe) automatically.

[glennrice]

No problem, happy to help keep testing. ;-)

Updated the agent and double checked to confirm the version now installed:

Unfortunately, this seems to have gone back a step: it doesn't show Authentik as a logon option anymore.

I tried completely removing the agent and reinstalling in case it was an upgrade issue - same result.

In case its relevant, I do see the following in event viewer:

[ak_cred_provider] [proc=1724, thread=13136] [::] Exception in ak_sys_auth_interactive_available: The system cannot find the file specified. (0x80070002)

[BeryJu]

Thanks for that, I'll look into it (our testing for the credential provider is currently quite manual, since as it turns out, automating it is quite complicated)

[BeryJu]

@glennrice #796 should fix this error, i've tested with the updated build and the login window appears without any error

[glennrice]

Thanks, I tried the latest build from https://pr-796--authentik-pkg.netlify.app/

But I am back to not even getting the Authentik logon option, let alone the pop up auth window.

I did notice, probably due to all my installing and uninstalling of agents, there were no RegistrationToken and URL registry keys under: HKEY_LOCAL_MACHINE\SOFTWARE\authentik Security Inc.\Platform\ManagedConfig

I tried creating them manually, and logging out and in, as well as restarting - no option to sign in with authentik.

Checking the logs doesn't show anything too wrong, except the following warning:

level=warning msg="failed to fetch config" error="403 Forbidden" logger=storage.config

Followed a second later by the following info:

level=info msg="Loaded domain config" logger=storage.config