The Okta AD Agent service does not start. AD Agent logs show the error message: 

Could not load encrypted configuration settings from C:\Program Files (x86)\Okta\Okta AD Agent\OktaAgentService.exe.config. Probably, the configuration file was encrypted by another user. Reinstall the agent to fix this issue.

2024/12/13 12:07:40.983-06:00 Info -- SERVER(4) -- Okta AD Agent starting
2024/12/13 12:07:40.985-06:00 Info -- SERVER(4) -- Service account: DOMAIN\service.account
2024/12/13 12:07:40.986-06:00 Info -- SERVER(4) -- Loading configuration file: C:\Program Files (x86)\Okta\Okta AD Agent\OktaAgentService.exe
2024/12/13 12:07:41.296-06:00 Info -- SERVER(4) -- BaseOktaURI: https://<org>.okta.com
2024/12/13 12:07:41.308-06:00 Error -- SERVER(4) -- Could not load encrypted configuration settings from C:\Program Files (x86)\Okta\Okta AD Agent\OktaAgentService.exe.config. Probably, the configuration file was encrypted by another user. Reinstall the agent to fix this issue.
2024/12/13 12:07:41.314-06:00 Info -- SERVER   at Okta.Agent.ClientConfig.LoadFromFile(String path, Boolean loadProtectedSettings)
   at Okta.Agent.AgentInstance.Start(Boolean logToConsole)
Okta.Agent.ClientConfigException received with message Could not load encrypted configuration settings from C:\Program Files (x86)\Okta\Okta AD Agent\OktaAgentService.exe.config. Probably, the configuration file was encrypted by another user. Reinstall the agent to fix this issue. Source=OktaAgentService InnerException=System.Security.Cryptography.CryptographicException: Key not valid for use in specified state.
	Caused by System.Security.Cryptography.CryptographicException received with message Key not valid for use in specified state.
 Source=System.Security InnerException=.
2024/12/13 12:07:41.315-06:00 Info -- SERVER(4) -- Okta AD Agent stopping
2024/12/13 12:07:41.315-06:00 Info -- SERVER(4) -- Okta AD Agent stopped

• Directories
• Active Directory
• Okta AD Agent

This message indicates the agent configuration file cannot be decrypted by the service account being used. This is commonly encountered after attempting to update the Okta AD Agent service account or restoring the AD Agent server from a backup.

It is necessary to perform a complete uninstall of the Okta AD Agent.

1. Uninstall the AD Agent using the Microsoft "Programs and Features" or "Apps and Features" components.
2. Delete or rename the folder C:\Program Files (x86)\Okta\Okta AD Agent. This is to ensure that the old configuration file will not be used during installation.
3. Perform a fresh install of the latest Okta AD Agent.
   • If there is no prompt to enter service account credentials during installation, then the old configuration file was not removed prior to installation. Cancel the install, remove/rename the folder, and start again. 

Related References

• Install the Okta Active Directory agent