Mideye sign-in screen messages and what each one means

This page is for administrators and helpdesk staff. The Mideye tile shows one plain sentence for each outcome. The same cause gives the same text on the console and over Remote Desktop. The event id is in the Application log, source “Mideye Credential Provider”.

Message	Cause	What to do
The code was not accepted. Sign in again.	A wrong code ended the attempt.	Sign in again with a new code.
That code was not accepted. Enter a new code.	A wrong code. The attempt stays open (event 1001).	Enter the next code.
Too many wrong codes. Try again later, or contact your administrator.	The wrong-code protection blocked the user (event 1014).	Wait 15 minutes, or unblock the user on Diagnostics.
The request was rejected on your phone.	Touch was rejected.	Sign in again and accept.
Your phone did not answer in time. Sign in again.	Touch timed out (event 1002).	Sign in again.
The request could not be sent to your phone. Contact your administrator.	Touch could not be delivered.	Check the user’s number and the backend.
Another sign-in request is still open. Answer it or wait a minute, then sign in again.	An earlier request is open or the rate limit was reached.	Answer it or wait.
Another sign-in for this account started. This one has ended.	A newer attempt took over.	Use the newer attempt.
Sign-in to this computer is not allowed for this account at this time.	A Deny rule or a Deny hour in the schedule (event 1001).	Check Users and the Schedule.
Your account has no sign-in method for this computer. Contact your administrator.	No phone number and no token for the user.	Add a phone number or token.
The Mideye Server cannot be reached. Try again later, or contact your administrator.	No backend answered (event 5810).	Check the network and `mideye cp health`.
The Mideye Server did not accept this sign-in. Contact your administrator.	The server refused this computer or the token is out of sync.	Check the API token and the user’s token.
Sign-in failed because of a configuration error on this computer. Contact your administrator.	The configuration is not active or not valid.	Run `mideye cp health` and check the configuration.
The sign-in was interrupted. Sign in again.	The sign-in screen was closed during the attempt.	Sign in again.
The sign-in timed out. Sign in again.	No input for 2 minutes.	Sign in again.
Sign-in cancelled.	The user selected Cancel.	None.

Break-glass

Message	Meaning
The break-glass code was not accepted.	A wrong, used, blocked or unverifiable break-glass code (event 5704 for an account, 5710 for a user).
Break-glass sign-in accepted. It has been recorded.	A break-glass sign-in succeeded (event 5701 or 5709).
Enter a reason of at least 4 characters.	The reason box was too short.
The Mideye service on this computer is not running. Only break-glass accounts can sign in.	The broker is stopped.
The Mideye configuration on this computer is not valid. Only break-glass accounts can sign in.	The configuration is refused.

Message	Meaning
Your approver denied the sign-in.	The approver rejected.
Your approver did not answer in time. Sign in again.	The approver did not answer.
The approver or the code was not accepted. Sign in again.	A wrong approver or code.
No approver can confirm this sign-in. Contact your administrator.	No approver with a phone or token is available.
Assisted Login cannot start right now. Contact your administrator.	Assisted Login is required but not available.
Mideye Server: approver lookup is off. Contact your administrator.	Enable approver lookup is off on the Authentication API endpoint (event 1001 `reason=OptionsLookupDisabled`).
Mideye Server: OTP approval is off. Contact your administrator.	Enable OTP approval is off on the Authentication API endpoint (event 1001 `reason=OtpApprovalDisabled`).

Passwords and Windows

Windows’ own texts stay as Windows writes them, for example “The user name or password is incorrect.” and “The referenced account is currently locked out and may not be logged on to.” Two Mideye texts matter:

Message	Meaning
Your password could not be checked right now because the domain controller cannot be reached. This does not mean it is wrong. Try again in a moment.	The domain controller is unreachable.
Windows did not say which account is signed in, so this screen cannot unlock it. Sign in again.	An unlock without a known account. Sign in again.

Over Remote Desktop with NLA, Windows checks the password before the session starts. A wrong, expired or locked password is refused by the RDP client itself.

Authenticator app enrollment

Message	Meaning
That code did not match. Try the next code from your app.	The confirmation code was wrong.
You already have an authenticator registered. Enter a code from it.	The user already has an app.
Enrollment is not available. Contact your administrator.	Enrollment is off.
The server could not be reached. Try again.	The Mideye Server did not answer.
Enrollment failed. Try again or contact your administrator.	Another failure (event 1008).

See Set up the authenticator app.

Logs and events for the log files and event IDs
Troubleshooting
Helpdesk handbook