Windows Okta Device Trust - Registration Task Install Error
Last Updated:
Overview
During a manual installation of the Windows Device Trust registration task—OktaDeviceRegistrationTaskSetup-1.[version].[version]—for a Windows domain-joined computer, the error below might be encountered in debug mode or in the Event Viewer log under Windows Logs > Applications and Services Logs > Okta Device Trust.
Exception running the Device Trust client for user ADPROD\user : System.Security.Cryptography.CryptographicException: Key not valid for use in specified state.
Full text of the error below:
Requesting and Installing new certificate Exception running the Device Trust client for user DOMAIN\user : System.Security.Cryptography.CryptographicException: Key not valid for use in specified state. at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer) at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle) at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair() at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize) at OktaDeviceTrustClient.OktaDeviceTrustCertificateManager.ConvertPrivateKeyToRSA(AsymmetricCipherKeyPair ackp) at OktaDeviceTrustClient.OktaDeviceTrustCertificateManager.CreateCertificateRequest(RSACryptoServiceProvider& privateKey) at OktaDeviceTrustClient.OktaDeviceTrustCertificateManager.RequestAndInstallCertificate(String userToken) at OktaDeviceTrustClient.OktaDeviceTrustClient.ExecuteUserTasks() at OktaDeviceTrustClient.Program.<>c__DisplayClass1.<Main>b__0() press any key to exit.
Applies To
- Windows Device Trust
- Okta Classic Engine
- OktaDeviceRegistrationTaskSetup-1.[version].[version]
Cause
This error is due to a corrupt Local User profile.
Solution
To resolve this issue, the old local user profile needs to be deleted, and the user's local Windows profile should be recreated. Microsoft's documentation on user profiles provides the necessary steps: About User Profiles.
For more information on installing the Windows device trust procedure, see the article Enforce Okta Device Trust for managed Windows computers. This article provides a more detailed guide on how to implement the Windows Device Trust correctly.
