Why is an OVService Account Created on Windows when Installing Okta Verify
Last Updated:
Overview
Okta Verify (OV) for Windows uses this method to separate the silent key from the user account to prevent other applications from accessing the key without user interaction and authenticating on behalf of the user. This approach is necessary because there is no sandbox available for Win32 applications on Windows. To ensure that the proof of possession keys remain accessible, it is essential to leave the associated service accounts in place. These were created with the credentials store for Okta Verify use.
To know what these accounts are used for, check under the local path pointing to C:\ProgramData\Okta\OktaVerify\Sandbox\<domain admin username>\OVService-18-0527
NOTE: The OVService account was not created after Okta Verify 4.8.1. However, it is still used when Okta Verify is updated from an earlier version (less than 4.8.1) to a later version (equal to or later than 4.8.1).
Applies To
- Okta Identity Engine (OIE)
- Okta Verify (OV)
- Multi-Factor Authentication (MFA)
Cause
Solution
An interim workaround for the impacted machines (like the Domain Controllers) would be to add the registry key HKLM\Software\Okta\Okta Verify\DisableSandbox as a DWORD with value 0x01 before installing the Okta Verify client.
