Okta Advanced Server Access And Okta Privileged Access Windows Server Enrollment Fails Via Enrollment Token

Okta fails to enroll a Windows server in Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) via an enrollment token when the token file is saved as a plain text file with a .txt extension. Resolve this issue by enabling file name extensions in File Explorer and removing the .txt extension from the enrollment token file. When creating an enrollment token in the C:\windows\system32\config\systemprofile\AppData\Local\ScaleFT directory, the file remains in the directory, and the server fails to enroll.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Windows Server

The error occurs because the Windows File Explorer hides file name extensions by default, causing the enrollment.token file to save as a standard text file named enrollment.token.txt. Okta requires the exact enrollment.token file name to process the enrollment.

How is the Windows server enrollment failure resolved?

Enable file name extensions in the Windows File Explorer and rename the enrollment token file to remove the text extension.

1. Navigate to the C:\windows\system32\config\systemprofile\AppData\Local\ScaleFT\ directory.
2. Click the View tab in the File Explorer navigation pane and select the File name extensions checkbox to reveal the .txt extension on the enrollment.token.txt file.
3. Rename the file to remove the .txt extension, leaving the file name as exactly enrollment.token, and press Enter to confirm the changes.
4. Wait a few minutes and refresh File Explorer to verify the enrollment.token file no longer appears in the directory.
5. Verify the server appears in the Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) dashboard.