.. Reminder for header structure:
  Parts (H1)          : #################### with overline
  Chapters (H2)       : ******************** with overline
  Sections (H3)       : ====================
  Subsections (H4)    : --------------------
  Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^
  Paragraphs (H6)     : """""""""""""""""""""

.. meta::
  :description: WAPT documentation version 2.7 Frequent problems and questions
  :keywords: lost password, lost private key, stolen private key, BIOS bug, waptdeploy, WAPT, documentation, the WAPT Deployment utility

.. _wapt_faq_console:

####################
FAQ - Console Issues
####################


**********************
Certificates and trust
**********************

Why is my certificate not trusted by a machine?
===============================================

When updating the repository, sending a message or adding a package, you may encounter the following error:

.. code-block:: text

  EWaptCertificateUntrustedIssuer('Issuer CA certificate CN=XXXX,C=FR can not be found in supplied bundle')

This error indicates that the certificate's issuing authority
cannot be found in the certificates provided for verification.

.. white_toggle::
   :titleen: Show solution
   :titlefr: Afficher la solution

   **1. Check your personal certificate**

   In the WAPT Console, open :guilabel:`Tools` > :guilabel:`Preferences` and verify the configured :guilabel:`Path to personal certificate`.

   **2. Check the trusted certificates on the target machine**

   Open the Certificates tab in the WAPT inventory and confirm that the certificate or its issuing CA is trusted.

   **3. Sign the certificate with a trusted CA if necessary**

   If the certificate is not trusted, create a certificate package and sign it with a certificate already trusted by the target machine.

   Follow the `certificate signing video guide <https://www.youtube.com/watch?v=mdUcQSdPqQ4>`_.

   **4. Retry the operation**

   Retry the update, message or package addition.

.. _msg_error_package:

***********************************************
Error message about package on the WAPT Console
***********************************************

.. white_toggle::
  :titleen: Error « File setup.py is not allowed in manifest of xxx »
  :titlefr: Error « File setup.py is not allowed in manifest of xxx »

  This error means that the certificate currently in use does not have the authority to sign packages.

  The only two options available are:

  1- Use a different certificate with code-signing rights.

  2- Regenerate a certificate by selecting the option :guilabel:`code signing` (information for build certificate :ref:`here <building_certificate>`).

  .. figure:: wapt-resources/wapt_code_signing_for_certificate.png
    :align: center
    :scale: 65%
    :alt: Code signing for certificate

    Code signing for certificate

.. white_toggle::
  :titleen: Error when uploading package
  :titlefr: Problème avec la création de paquet

  .. figure:: wapt-resources/wapt_error_trusted_signer_certificate.png
    :align: center
    :scale: 75%
    :alt: Window showing that the uploaded package has signer certificate issue

    Window showing that the uploaded package has signer certificate issue

  The WAPT Console shows this error ; Error when uploading package: EWaptForbidden('Host matching package UUID_HOST does not trusted signer certificate').

  You have this error when you try to upload a WAPT package but the used certificate which signed package is not present in your computer's ssl WAPT install location folder. Be reminded, if you have a WAPT Server running on Windows to **not lauch the WAPT Console on the server**. Add the WAPT certificate which signed the package in your computer's ssl WAPT install location folder then retry.

.. white_toggle::
  :titleen: Local Error
  :titlefr: Erreur locale

  .. figure:: wapt-resources/wapt_console_local-error-dialog-box.png
      :align: center
      :alt: Window showing that the WAPT Console does not find a package

      Window showing that the WAPT Console does not find a package

  The WAPT Console shows this error in two situations.

    **Package does not exist in the repository anymore, yet a host needs it**

    There are two possible solutions:

    - Try to get package anew from Tranquil IT's store.

    - Delete the package from the host dependencies.

  OR

    **When you try to install a package with a locale that is unknown to the host**

    There are two possible solutions:

    * Download the WAPT package having the matching locale from Tranquil IT's store.

    * Edit your WAPT package and set in the :file:`control` file the option :code:`locale` with the correct locale (:code:`locale=en,fr`).

.. _msg_error_open:

******************************************
Opening and connecting to the WAPT Console
******************************************

Why is my WAPT Console version different from the WAPT Server version?
=======================================================================

The WAPT Console and the WAPT Server are running different versions.
This may cause compatibility issues.

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  Upgrade the WAPT Console to the same version as the WAPT Server.

  .. image:: wapt-resources/wapt_console_version-error_dialog-box.png
    :align: center
    :scale: 75%
    :alt: Warning indicating that the WAPT Console version is out of date

Why can't the WAPT Console connect to the WAPT Server?
======================================================

The WAPT Console cannot contact the WAPT Server on port 443.
This may indicate that the Nginx web service is stopped or unable
to start.

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  **1. Check whether Nginx is running**

  On a Linux WAPT Server, run:

  .. code-block:: bash

    systemctl status nginx

  **2. Restart Nginx if necessary**

  If Nginx is not running, restart the service:

  .. code-block:: bash

    systemctl restart nginx

  **3. Check the logs if Nginx fails to start**

  If the service still does not start, inspect the Nginx logs:

  - Linux: ``/var/log/nginx/``
  - Windows: ``C:\Program Files (x86)\wapt\waptserver\nginx\logs``

Why is the WAPT Server service unavailable?
============================================

The WAPT Server service may be stopped or may have failed to start.

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  **1. Check the service status**

  On a Linux WAPT Server, run:

  .. code-block:: bash

    systemctl status waptserver

  **2. Start the service if necessary**

  If the service is stopped, run:

  .. code-block:: bash

    systemctl start waptserver

Why does the WAPT Console report an SSL certificate verification error?
========================================================================

The WAPT Console cannot verify the HTTPS certificate presented by
the WAPT Server.

.. attention::

  Before changing any certificate or verification settings, make sure that the error is not caused by a :abbr:`MITM (Man-in-the-Middle)` attack.

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  **Case 1: The WAPT Server has recently been rebuilt**

  If you have rebuilt your WAPT Server and use a self-signed certificate, you may be able to recover the previous server's certificates and keys from:

  .. code-block:: text

    /opt/wapt/waptserver/apache/ssl

  **Case 2: Reset the local WAPT Console configuration**

  Close the WAPT Console and delete the following folder:

  .. code-block:: text

    %LOCALAPPDATA%\waptconsole


  **Case 3: Re-enable certificate verification**

  Run the following command:

  .. code-block:: bash

    wapt-get enable-check-certificate

  Make sure the command completes successfully.

  Restart the WAPT service:

  .. code-block:: bat

    net stop waptservice && net start waptservice

  Finally, restart the WAPT Console.

  **Case 4: Check the server's certificate chain**

  If you do not use certificate pinning, this error may indicate that the certificate presented by the WAPT Server cannot be verified using Python's ``certifi`` certificate bundle. Make sure that the WAPT Server provides the complete certificate chain, including any required intermediate certificates.

Why are all actions disabled in the WAPT Console?
=================================================

The WAPT Console may appear locked, with all actions greyed out,
if the connected user does not have the required permissions.

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  **1. Open the WAPT Console as Superadmin**

  Close the WAPT Console and reopen it using the ``Superadmin`` account.

  **2. Check the user's permissions**

  Navigate to:

  .. code-block:: text

    Tools > Manage Wapt users and rights

  Select the affected user and grant the appropriate permissions.

  **3. Save and reconnect**

  Save the changes, close the WAPT Console, and reopen it using the user's usual account.

*****************************************
Managing the location of machines in WAPT
*****************************************

Why does a machine appear in the wrong Organisation Unit (OU)?
===============================================================

The WAPT Server does not automatically determine the location of a
newly deployed machine. The WAPT agent installed on the machine
transmits this information to the WAPT Server based on the data
available when it communicates with the server.

The machine's current OU is stored in the following Windows registry key:

.. code-block:: text

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Distinguished-Name

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  **1. Check the OU known by the machine**

  In the WAPT Console, identify the machine concerned.

  Go to the :guilabel:`Hardware Inventory` tab.

  Look for the :guilabel:`computer_ad_dn` key. Its value corresponds to the OU that the machine has communicated to the WAPT Server.

  **2. Update the machine's Group Policy information**

  If the value of :guilabel:`computer_ad_dn` corresponds to the old OU, force the machine to update its Group Policy information.

  **Via the command prompt:**

  Run the following command on the machine:

  .. code-block:: bash

    gpupdate /force

  **Via the WAPT Console:**

  - Select the workstation concerned.
  - Right-click > :guilabel:`Windows Computer Management`.
  - Choose :guilabel:`Update AD Group Policies on hosts`.

  Once the update has been performed, the machine should appear in the new OU in the WAPT inventory.

Why are duplicate or legacy Windows Update KBs displayed in WAPT?
=================================================================

.. image:: wapt-resources/wapt-duplicate_KBS.png
   :align: center
   :scale: 75%
   :alt: Duplicate KBs displayed in WAPT

A Windows 11 device running version 25H2 may display cumulative updates intended for earlier releases, such as 22H2, 23H2, or 24H2, in the :guilabel:`Windows Updates` tab of the WAPT Console.

At first glance, this may suggest that updates for older Windows versions are being installed on the device. Fortunately, this is not the case.

.. white_toggle::
  :titleen: Why does this happen?
  :titlefr: Pourquoi cela se produit-il ?

  Microsoft is aware of this behavior and has acknowledged it in its support forums, although the issue has not yet been resolved.

  See the `Microsoft discussion <https://learn.microsoft.com/en-us/answers/questions/2157261/duplicate-cumulative-kb-windows-11-update-returns>`_.

  The information displayed in the :guilabel:`Windows Updates` tab comes directly from the native Windows Update Agent and is not modified by WAPT.

  WAPT intentionally preserves the original data returned by Windows Update so that administrators can work with the information exactly as provided by Microsoft.

  While the presence of duplicate or legacy-version KBs can make the update list more difficult to read, this is purely a display issue. It does not affect the update installation process.

  Windows Update will only install the cumulative update that matches the operating system version running on the device.
   
  For example, on a Windows 11 25H2 system, only the KB package intended for 25H2 will be installed, even if updates targeting 22H2, 23H2, or 24H2 are also listed in the console.

How can I check which Windows updates are actually installed?
===============================================================

.. white_toggle::
  :titleen: Show solution
  :titlefr: Afficher la solution

  To verify which updates are actually installed on a device, run the following PowerShell command:

  .. code-block:: powershell

    Get-Hotfix