Authentication to Agents Failed with “Authentication Failure” Error (4036261)

Sometimes the Core client certificates are changed when upgrading either the AppAssure or Rapid Recovery software or installing Windows updates. When the certificate is changed, the connection to the agents will fail with an “authentication failure” error message.

After installing Windows updates on the Core and agent servers, agents are unable to authenticate to the Core. Additional pairing errors also prevent users from adding or re-adding agents to protection.You might encounter log error messages and events similar to the following.

Applicable Log Errors
ERROR [date and time] [4] – Replay.ServiceHost.Implementation.Hosting.ListenerService ()
Caught exception processing HTTP operation
System.ObjectDisposedException: Safe handle has been closed

ERROR [date and time] [12] – Replay.ServiceHost.Implementation.Hosting.ServiceHost (RequestUri=https://yourdomain:8006/apprecovery/api/agent/servicehost/restart ClientAddress=192.168.255.255:65427)
Service Host Error: Service error while handling request [GET https://yourdomain:8006/apprecovery/api/agent/servicehost/restart]: The handle is invalid
Request Uri: https://yourdomain:8006/apprecovery/api/agent/servicehost/restart
Client Address: 192.168.255.255:65427
Identity: Negotiate:NT AUTHORITY\SYSTEM
Service: Replay.ServiceHost.Implementation.Hosting.ServiceHostManagement
Method: Restart

Applicable Eventvwr Events
Log Name: System
Source: Schannel
Date: [date and time]
Event ID: 36885
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: Computername.local

Re-pair the agents:

1. At the top of the core console, click the arrow beside Protect 
2. Select either Protect Machine or Bulk Protect
3. Re-enter the machine names and credentials
4. The core will automatically repair the connection, and the agents will then show as online

If the Core client certificates were changed after installing Windows updates, please refer to this Microsoft article.

1. Go to the agent machine.
2. Select Run and type certmgr.msc.
3. Go to Trusted Root Certification Authorities and choose Certificates.
4. Find certificates with name of Core and browse it. Then press Copy to file.
5. In the Certificate Export Wizard, select the Yes, export the private key and click Next.
6. In Export file format, leave the default values and click Next.
7. In the Security window, create and type your password and then specify the path to save the certificate.
8. Click Next and then click Finish.
9. Go to the location where you have saved your certificate and copy it to the Core machine.
10. Go to Agent Registry HKEY_LOCAL_MACHINE\SOFTWARE\AppRecovery\Agent\AgentPairingSettings and copy  the value data of CoreClientCertificateThumbprint to .txt file. Then, copy this .txt  file to Core machine.
11. Go to Core machine.
12. Stop the Core Service.
13. Open Registry on the Core machine and go to HKEY_LOCAL_MACHINE\SOFTWARE\AppRecovery\Core\CertificateService.  Then change value data of  LocalClientThumbprint to the data from .txt file.
14. Delete key LocalClientCertificate from Registry (HKEY_LOCAL_MACHINE\SOFTWARE\AppRecovery\Core\CertificateService).
15. Copy the location of the exported certificate (C:\1.pfx for example) on the Core machine and then open the certificates console on that same machine. Click on Trusted Root CA – Certificate and then right click Certificates. Select All Tasks and then select Import.
16. Click Next.
17. In the following window, paste the location of the certificate and click Next. Select the check box Mark this key as exportable and enter the password and then click Next.
18. In the following window leave the default values and click Next
19. Click Finish
20. Start the Core Service and browse Agent metadata.