SolarWinds Agent install fails with Error [0x57] – clientcertificatecache::initialize() – deviceID empty

2/11/2026 10:21 PM

2/11/2026 10:21 PM

When deploying the SolarWinds Agent to a Windows server (push or manual MSI), the installation or provisioning fails. The Windows credentials validate and the \\server\admin$ share is accessible, but the agent still cannot complete installation. Agent logs show certificate/crypto‑related errors, such as:

• Error [0x57], [clientcertificatecache::initialize() - deviceID empty]

• Error Code [87] – The parameter is incorrect

• Error Code [5] – Access is denied

This behavior is caused by a local certificate/permissions problem on the target server, not by bad credentials or firewall to admin$.

 

Network Performance Monitor

These errors indicate that the agent is unable to create or access its local certificate and private key in the Windows crypto store. Typical causes include:

• Incorrect or overly restricted permissions on:

  • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\

• Stale or corrupted agent certificates in the Local Computer certificate store.

• Antivirus / EDR software blocking access to the crypto store or blocking the agent process during certificate creation.

Because \\server\admin$ access and credential validation already succeed, the failure is not in the file share or credential layer, but in local certificate/crypto/permissions.

Follow the steps below on the affected server.

A) Clean up any old SolarWinds Agent installation

1. Log in to the target server with a local admin / domain admin account.

2. Open Programs and Features (appwiz.cpl).

3. If SolarWinds Agent is listed, uninstall it.

4. After uninstall completes, reboot the server.

This ensures a clean starting point for agent provisioning.

---

B) Fix certificate store and MachineKeys permissions

1. Open the Local Computer certificate store

   • Run mmc.

   • Go to File > Add/Remove Snap-in….

   • Select Certificates → click Add.

   • Choose Computer account → Next → Local computer → Finish → OK.

2. Remove stale SolarWinds agent-related certificates

   Under Certificates (Local Computer), check and delete (if present):

   • SolarWinds-Orion

   • SWI-Agent-JobEngineService

   • SWI-Orion-Agent

   (These may be under Personal, Trusted People, or other subfolders, depending on environment.)

3. Check and fix MachineKeys permissions

   • Navigate to:

     C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\
     

   • Right‑click MachineKeys → Properties → Security → Advanced.

   • Verify that at least:

     • SYSTEM – Full control

     • Administrators (local admins group) – Full control

   • If these entries are missing or permissions are restricted:

     • Add/adjust them.

     • Apply to “This folder, subfolders and files.”

4. (Optional diagnostic) Temporarily broaden permissions

   If the agent still fails after correcting SYSTEM/Administrators:

   • For testing only, temporarily add:

     • Everyone – Full control

   • Retry the agent installation.

   • If it now succeeds, remove Everyone and revert to appropriate least‑privilege permissions (keeping SYSTEM and Administrators with full control).

---

C) Check antivirus / endpoint security

Some AV/EDR solutions block:

• Access to MachineKeys, or

• The agent process while it generates or accesses certificates.

To rule this out:

1. Temporarily disable AV/EDR on:

   • The SolarWinds Platform/Orion server, and

   • The affected agent server,

   or

2. Add exclusions for the following paths on both servers:

   • C:\Program Files (x86)\SolarWinds\Agent\

   • C:\ProgramData\SolarWinds\

   • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\

After adjusting AV/EDR, retry the agent installation.

---

D) Verify Agent Management Service connectivity

From the agent server, verify HTTPS connectivity to the Agent Management Service:

1. Open a browser and browse to:

   https://<OrionServerName>:17778/solarwinds/agentmanagement/api/TestConnection
   

2. Accept any certificate warning.

3. If you see a response such as:

   Agent Management Service version x.x.x.x – Connection OK
   

   then HTTPS connectivity to the Agent Management Service is working.

If the page cannot be displayed (timeout, proxy error, etc.), resolve the network/firewall/proxy issues before proceeding. The agent cannot successfully provision without this connection.

---

E) Reinstall or redeploy the agent

After completing the steps above, reinstall the agent using one of the options below.

Option A – Push deployment from the SolarWinds web console

1. In the SolarWinds web console, go to:
   Settings > All Settings > Manage Agents.

2. Under Agent Deployment Credentials, configure the same account you previously verified with:

   net use \\<servername>\admin$ /user:DOMAIN\UserName
   

3. On the target server, ensure the Server and Remote Registry services are running.

4. Retry the push deployment to this node.

Option B – Manual MSI install with logging

1. In the SolarWinds web console, go to:
   Settings > All Settings > Manage Agents → download the Windows offline/manual installer.

2. Copy SolarWinds-Agent.msi to the target server (for example, C:\Temp).

3. From an elevated Command Prompt on the agent server, run:

   msiexec /i "C:\Temp\SolarWinds-Agent.msi" /L*V "C:\Temp\SWAgentInstall.log"
   

4. Allow the installer to run to completion, even if it fails, so that a full log is generated.

---

F) If the issue persists – collect diagnostics

If the agent still does not install or start after the steps above, collect the following for support:

From the agent server:

• C:\Temp\SWAgentInstall.log (from the MSI command above)

• C:\ProgramData\SolarWinds\Logs\Agent\SolarWinds.Agent.Service*.log

From the Orion/Platform server:

• C:\ProgramData\SolarWinds\Logs\AgentManagement\AgentManagement.Service.log

These logs will show the complete provisioning and certificate flow around the 0x57 / “deviceID empty” and Access is denied (0x5) errors and help identify any remaining blockers (for example, residual permissions issues, certificate store errors, or AV/EDR interference).

In confirmed cases, performing the steps above (particularly fixing MachineKeys permissions, clearing stale certificates, and adjusting AV/EDR) has allowed the agent to install and provision successfully on previously affected servers.