GSA Windows client health check

This page's changes and edits · All guidance changes

Microsoft's edit · 13 Aug 2024 22:10 UTC

Aug 13 updates from Liraz feedback

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7f354e9 · +21 ~~−21~~ lines · also on GitHub

⋯ 2 unchanged lines

33 description: Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

44 ms.service: global-secure-access

55 ms.topic: troubleshooting

6 −ms.date: 08/08/2024

6 +ms.date: 08/13/2024

77 ms.author: jayrusso

88 author: HULKsmashGithub

99 manager: amycolannino

⋯ 81 unchanged lines

9191 `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfile`

9292

9393 If the registry key doesn't exist, try to force forwarding policy retrieval:

94 −1. Delete the `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfileVersion` registry key, if it exists.

94 +1. Delete the `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfileTimestamp` registry key, if it exists.

9595 1. Restart the service, `Global Secure Access Policy Retriever Service`.

9696 1. Check if the two registry keys are created.

9797 1. If not, look for errors in the Event Viewer.

⋯ 5 unchanged lines

103103

104104 1. Delete the following registry keys:

105105 - `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfile`

106 − - `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfileVersion`

106 + - `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\ForwardingProfileTimestamp`

107107 1. Restart the service, `Global Secure Access Policy Retriever Service`.

108108 1. Restart the Global Secure Access client.

109109 1. Run the health check again.

⋯ 19 unchanged lines

129129 If this test fails, it's usually because of an internal problem with Global Secure Access. Contact Microsoft Support.

130130

131131 ### Authentication certificate exists

132 −This test verifies that a certificate exists on the device for the Mutual Transport Layer Security (MTLS) connection to the Global Secure Access cloud service.

132 +This test verifies that a certificate exists on the device for the Mutual Transport Layer Security (mTLS) connection to the Global Secure Access cloud service.

133133 > [!TIP]

134134 > This test doesn't appear if mTLS isn't enabled for your tenant yet.

135135

136136 If this test fails, enroll in a new certificate by completing the following steps:

137137 1. Launch the Microsoft Management console by entering the following command in the Command Prompt: `certlm.msc`.

138138 1. In the **certlm** window, navigate to **Personal** > **Certificates**.

139 −1. Delete the certificate that ends with **gsa.client**.

139 +1. Delete the certificate that ends with **gsa.client**, if it exists.

140140 :::image type="content" source="media/troubleshoot-global-secure-access-client-diagnostics-health-check/troubleshoot-health-check-gsa-client.png" alt-text="Screenshot of the list of certificates with the gsa.client certificate highlighted.":::

141141 1. Delete the following registry key:

142142 `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\CertCommonName`

143143 1. Restart the Global Secure Access Management Service in the services MMC.

144144 1. Refresh the certificates MMC to verify that a new certificate was created.

145 −*The refresh might take a few minutes.*

145 +*Provisioning a new certificate might take a few minutes.*

146146 1. Check the Global Secure Access client event log for errors.

147147 1. Run the Health check tests again.

148148

149149 ### Authentication certificate is valid

150 −This test verifies that the authentication certificate used for the MTLS connection to the Global Secure Access cloud service is valid.

150 +This test verifies that the authentication certificate used for the mTLS connection to the Global Secure Access cloud service is valid.

151151 > [!TIP]

152152 > This test doesn't appear if mTLS isn't enabled for your tenant yet.

153153

⋯ 6 unchanged lines

160160 `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client\CertCommonName`

161161 1. Restart the Global Secure Access Management Service in the services MMC.

162162 1. Refresh the certificates MMC to verify that a new certificate was created.

163 −*The refresh might take a few minutes.*

163 +*Provisioning a new certificate might take a few minutes.*

164164 1. Check the Global Secure Access client event log for errors.

165165 1. Run the Health check tests again.

166166

⋯ 55 unchanged lines

222222 1. Verify that the system tray icon is visible.

223223 1. If the sign-in notification appears, select **Sign in**.

224224 1. If the sign-in notification doesn't appear, check if it is in the Notification Center and select **Sign in**.

225 −1. Complete the Entra sign-in process using the same tenant that the device is joined to.

225 +1. Sign in with a user that is a member of the same Entra tenant that the device is joined to.

226226 1. Verify the network connection.

227227 1. Hover over the system tray icon and verify that the client is **not** disabled by your organization.

228228 1. Restart the client and wait for a few seconds.

⋯ 15 unchanged lines

244244 For more information, see [Guidance for configuring IPv6 in Windows for advanced users](/troubleshoot/windows-server/networking/configure-ipv6-in-windows).

245245

246246

247 −### Private access edge hostname resolved by DNS

247 +### Edge hostname resolved by DNS

248 +This test checks all active traffic types: **Microsoft 365**, **Private Access**, and **Internet Access**.

248249 If this test fails, the DNS can't resolve the hostnames of the Global Secure Access cloud service, and therefore the service isn't reachable. This failed test could be due to an internet connectivity problem or a DNS server that doesn't resolve public internet hostnames.

249 −This test checks all active traffic types: Microsoft 365, Private Access, and Internet Access.

250250

251251 To verify that the hostname resolution works correctly:

252252 1. Pause the client.

⋯ 2 unchanged lines

255255 1. Verify that the DNS servers are configured for this machine: `ipconfig /all`

256256 1. If the previous steps don't resolve the issue, consider setting another public DNS server.

257257

258 −### Private access edge is reachable

258 +### Edge is reachable

259 +This test checks all active traffic types: **Microsoft 365**, **Private Access**, and **Internet Access**.

259260 If this test fails, the device doesn't have a network connection to the Global Secure Access cloud service.

260 −This test checks all active traffic types: Microsoft 365, Private Access, and Internet Access.

261261

262262 If the test fails:

263263 1. Verify that the device has an internet connection.

⋯ 28 unchanged lines

292292 1. Set a system environment variable in Windows named `grpc_proxy` to the value of the proxy address. For example, `http://10.1.0.10:8080`.

293293 1. Restart the Global Secure Access client.

294294

295 −### Tunneling succeeded Private Access

296 −This test checks each active traffic profile in the forwarding profile (M366, Private Access, internet Access) to verify that connections to the health service of the corresponding channel are tunneled successfully.

295 +### Tunneling succeeded

296 +This test checks each active traffic profile in the forwarding profile (**Microsoft 365**, **Private Access**, and **Internet Access**) to verify that connections to the health service of the corresponding channel are tunneled successfully.

297297

298298 If this test fails:

299299 1. Check the Event Viewer for errors.

⋯ 14 unchanged lines

314314 :::image type="content" source="media/troubleshoot-global-secure-access-client-diagnostics-health-check/troubleshoot-health-check-filtered-logs.png" alt-text="Screenshot of the Event Viewer showing a filtered log list.":::

315315 1. Save the filtered log as a file and attach the log file to the support ticket.

316316

317 −### QUIC not supported for internet Access

318 −Since QUIC isn't yet supported for internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.

317 +### QUIC not supported for Internet Access

318 +Since QUIC isn't yet supported for Internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.

319319 > [!TIP]

320320 > QUIC is currently supported in Private Access and Microsoft 365 workloads.

321321

322 −Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in internet Access.

322 +Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access.

323323

324 −#### QUIC disabled in Microsoft Edge

324 +### QUIC disabled in Microsoft Edge

325325 To disable QUIC in Microsoft Edge:

326326 1. Open Microsoft Edge.

327327 1. Paste `edge://flags/#enable-quic` in the Address bar.

328328 1. Set the **Experimental QUIC protocol** drop-down to **Disabled**.

329329

330 −#### QUIC disabled in Chrome

330 +### QUIC disabled in Chrome

331331 To disable QUIC in Google Chrome:

332332 1. Open Google Chrome.

333333 1. Paste `chrome://flags/#enable-quic` in the Address bar.

334334 1. Set the **Experimental QUIC protocol** drop-down to **Disabled**.

335335

336 −#### QUIC disabled in Mozilla Firefox

336 +### QUIC disabled in Mozilla Firefox

337337 To disable QUIC in Mozilla Firefox:

338338 1. Open Firefox.

339339 1. Paste `about:config` in the Address bar.

⋯ 2 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.