Heartbeat Status Codes

  • AccessDenied: Account does not have the rights to log into the resource. Example: Remote login is not enabled for a Windows local account.
  • AccountLockedOut: Account is locked out in the domain or on the workstation for Windows local accounts or Linux accounts.
  • AuthProtocolUnavailable: The target accepted the network connection but rejected the authentication because NTLM is disabled on the target and Kerberos cannot authenticate the account. This applies to local Windows accounts and to targets that are not joined to a domain. The heartbeat log shows the message "Authentication protocol unavailable. Local Windows accounts and non-domain targets require NTLM, which is disabled on the target. Contact your administrator." To resolve the failure, use an Active Directory account in UPN form (user@domain.com) and enter the target's fully qualified domain name in the secret so that Kerberos is used, join the target to the domain, or review the Network security: Restrict NTLM policies on the target. Available in Secret Server 12.2.000007 and later.
  • ArgumentError: Incorrect arguments have been provided to complete the Heartbeat. Example: Trying to use the new Entra ID secret template without a privileged secret mapped.
  • Disabled: Heartbeat is disabled because the secret used QuantumLock, does not exist, is disabled, or does not have the correct license level activated.
  • DnsMismatch: secret-server connected to an unexpected host when trying to complete a heartbeat, likely a DNS or network problem.
  • Failed: The credentials are either incorrect or the account does not have permission to log in.
  • Failed Unknown: Catch-all for any responses we don't recognize.
  • IncompatibleHost: An incompatible function was applied to the device or source. Example: Trying to use a Linux password changer for a Windows account.
  • NeedsImmediateRetry: The heartbeat feature uses PowerShell, and the MaxShellsPerUser amount was exceeded and will be tried again.
  • Pending: The secret is set to be processed during the next batch of processing.

  • PrivilegedAccountRequired: Secrets that require a privileged account to run a heartbeat, but the account was not linked or was missing when the heartbeat was queued.

  • Processing: The heartbeat was sent to the engine for processing and secret-server is awaiting a response.

  • Success: Successful credential validation.

  • UnableToConnect: Secret Server was unable to contact the target system. Ensure that the domain, IP address, or hostname is correct and resolvable from the server that Secret Server is installed on.

  • UnableToValidateServerPublicKey: The target's SSH host key digest did not match the digest mapped to the secret's "Server SSH Key" field. The heartbeat log shows the expected and actual values. This is not a credential failure. See Server SSH Key Verification.

  • UnknownError: Secret Server reached the target or a resource such as Active Directory but could not determine the reason for the failure. Example: "User Name could not be found." Check the heartbeat log on the Remote Password Changing page for details, and contact Support for assistance. Before Secret Server 12.2.000007, heartbeats against Windows targets with NTLM disabled also returned this status. They now return AuthProtocolUnavailable.

Event Pipelines and heartbeat failure notifications treat any status other than Success, Pending, Disabled, or UnableToConnect as a heartbeat failure. This means that Processing and AuthProtocolUnavailable are both treated as failures.

SSH Key Authentication Failures on Linux Targets

A Linux SSH key secret can report a failed heartbeat with the log message (LoginFailed). Exception: Connection Failed - Connection lost due to error 96258 even though the key and account are valid. This occurs when the target's SSH server does not accept the public-key signature algorithm that Secret Server offers. The default Delinea cipher suite authenticates RSA keys with rsa-sha2-256 and rsa-sha2-512 (see SSH Cipher Support); SSH servers that predate OpenSSH 7.2, such as the OpenSSH 5.3 shipped with RHEL 6 and CentOS 6, do not support them.

To confirm, check the target's SSH server log (/var/log/secure on RHEL and CentOS, /var/log/auth.log on Debian and Ubuntu) at the time of the heartbeat for:

userauth_pubkey: unsupported public key algorithm: rsa-sha2-256

For SSH handshake debugging on the client and server side, see SSH Issues. For command-set troubleshooting of Linux heartbeat and RPC, see Heartbeat and RPC Errors for Linux Secrets.

Enabling the built-in guest user in Active Directory can cause confusion because heartbeat returns a "success" status for non-existent accounts. To avoid this, disable the guest user when setting up AD.