Helpdesk handbook for Mideye MFA at Windows sign-in
This page is for the helpdesk staff who answer calls from users who cannot sign in. It gives a quick triage, the common problems and when to escalate.
30-second triage
Section titled “30-second triage”- What does the screen say? Ask for the exact sentence. Most sentences are listed in Error messages.
- Which method? Touch request, one-time code, Assisted Login.
- Console or Remote Desktop? Both should give the same text.
- Does one user fail, or everyone? Everyone: check the backend and the computer (
mideye cp health). One user: check the user’s phone number or token. - Look at the Application log, source “Mideye Credential Provider”, around the time. Event 1001 names the reason.
Common user problems
Section titled “Common user problems”| What the user says | Likely cause | What to do |
|---|---|---|
| “It says my account has no sign-in method.” | No phone number or token for the user. | Add the phone number (AD mobile) or token serial. |
| “I never got the request on my phone.” | No phone number, no signal, or the Mideye Server cannot send Touch. | Check the number. Let the user choose Enter a code. |
| “It says too many wrong codes.” | The wrong-code protection blocked the user (event 1014). | Wait 15 minutes, or unblock the user on Diagnostics. |
| “My code is not accepted.” | Wrong or old code, or a token out of sync. | Try the next code. Resync the token on the Mideye Server if it repeats. |
| “It says the Mideye Server cannot be reached.” | Backend or network trouble. | Check mideye cp health. Break-glass still works. |
| “It says the Mideye service is not running.” | The broker is stopped. | Start the MideyeBroker service. Only break-glass accounts can sign in meanwhile. |
| “I lost my phone.” | The user has no second factor. | Use Assisted Login, below, and issue a new token or number. |
| “It says my password could not be checked right now.” | The domain controller cannot be reached. It does not mean the password is wrong. | Try again, or connect to the network. |
| “It says another sign-in started.” | A newer attempt for the account took over. | Sign in again. |
| “My password expired.” | Windows requires a new password. | The tile asks for a new password after MFA at the console. |
| “It says the sign-in timed out.” | No typing for 2 minutes. | Sign in again. |
Assisted Login on someone’s behalf
Section titled “Assisted Login on someone’s behalf”If a user lost their phone or token, and the user is in an Assisted Login group, use Assisted Login. Check who is calling before you approve or read out a code. Never read out a code to someone you have not identified. Meanwhile, arrange a new token or number.
If the user is not in an Assisted Login group, an administrator can use the break-glass code or the break-glass account. Break-glass use is recorded.
When to escalate
Section titled “When to escalate”Escalate to the endpoint administrator when:
mideye cp healthreports a problem that is not the network;- several users fail at the same time on one computer;
- event 1011, 5301, 5303, 5304 or 5503 appears;
- a computer shows the Windows tiles when it should show only Mideye;
- you suspect someone is guessing codes (bursts of 1014, 5704 or 5710, or any 5711).
Escalate to Mideye support with the data listed in Logs and events.
Logging the call
Section titled “Logging the call”Record the user, the computer, the time with time zone, the exact message, the method, and what you did. Put the ticket number in the reason field when you use a break-glass code, so it is recorded in the event.