5V0-62.22 VMware Workspace ONE 21.X UEM Troubleshooting Specialist Questions and Answers

The root cause of this problem is that this organization group is not a Customer type OG. The Hub Services settings page is only available for Customer type OGs, which are the top-level OGs in the hierarchy1. The Hub Services settings page allows the administrator to configure various features and services for the Intelligent Hub app, such as notifications, people, home, and catalog1. The administrator should navigate to the Customer type OG to access the Hub Services settings page.

 The two root causes that could possibly cause this problem are that the device has not checked in with the Workspace ONE UEM tenant, and that the Policy Engine Service is not running. The device check-in is a process that updates the device status and information in the Workspace ONE UEM console3. If the device has not checked in with the Workspace ONE UEM tenant, it will not receive the latest compliance policy or report its compliance status. The Policy Engine Service is a service that evaluates and enforces compliance policies on devices. If the Policy Engine Service is not running, it will not be able to detect or remediate non-compliant devices. The administrator should check and resolve any issues with device check-in and Policy Engine Service.

 The two log files that can be reviewed to understand what may be the underlying issue for the enrollment error are Enrollshortcut.log and Device Management log. Enrollshortcut.log is a log file that records the enrollment process of devices using the Intelligent Hub app. Device Management log is a log file that records the device management events, such as enrollment, unenrollment, commands, profiles, and policies. These log files can help identify and troubleshoot any errors or issues related to device enrollment.

The service that the organization administrator has direct control over to enable verbose logging to troubleshoot this issue is ACC (AirWatch Cloud Connector) service. ACC is a service that integrates Workspace ONE UEM with internal enterprise systems, such as Active Directory or Certificate Authority. ACC enables Workspace ONE UEM to use internal resources without exposing them to the Internet. If some users are unable to enroll their devices using their Active Directory accounts, it could indicate that there is a problem with ACC configuration, connectivity, or synchronization. Enabling verbose logging for ACC can help identify and troubleshoot the root cause of the issue.

The Content Gateway certificate on the organization’s UAG is invalid. The Content Gateway certificate is a certificate that allows UAG (Unified Access Gateway) to communicate with Workspace ONE UEM and provide secure access to content on file servers on the internal network. If the Content Gateway certificate is invalid, expired, or mismatched, UAG will not be able to establish a secure connection with Workspace ONE UEM, and the Content Gateway edge service will show a red health check indicator. The administrator should check and renew the Content Gateway certificate if needed.

The most likely cause of this issue is that the VPN payload in the Android device profile is configured incorrectly in UEM. The VPN payload defines how devices connect to the VMware Tunnel edge service and access internal resources. If the VPN payload is incorrect, the devices will not be able to establish a VPN connection with the VMware Tunnel edge service and access server resources on the organization’s internal network. The administrator should review and correct the VPN payload settings in UEM.

The communication path that should be reviewed is AWCM outbound to UAG. AWCM (AirWatch Cloud Messaging) is a service that delivers push notifications to devices and enables device-based commands from the Workspace ONE UEM Console3. AWCM also communicates with UAG (Unified Access Gateway) to send server traffic rules for tunnel to proxy certain URLs. If AWCM cannot communicate with UAG, the server traffic rules will not be updated on UAG and the sites/apps will be proxied incorrectly. The administrator should check and resolve any issues with AWCM outbound to UAG communication.

The connection flow that should be examined to gain this insight is device connection to Device Services. Device Services is a component of Workspace ONE UEM that handles device enrollment, management, and communication. Device Services also hosts the AWCM service, which is responsible for delivering push notifications to devices. If devices have stopped updating their last seen time within the console, it could indicate that there is a problem with device connection to Device Services. The administrator should check and resolve any issues with device connection to Device Services.

The connectivity that should be investigated to restore ACC functionality is from the ACC to the Active Directory server. The error message in the ACC logging indicates that the ACC cannot connect to the Active Directory server due to a network error. This could be caused by firewall settings, proxy settings, network configuration, or other factors that prevent the ACC from communicating with the Active Directory server. The administrator should check and resolve these issues to restore the ACC functionality2.

The misconfiguration that would be causing this behavior is AWCM Persistence is not correctly configured. AWCM Persistence is a setting that ensures that devices maintain a consistent connection with the same AWCM server in a load-balanced environment. If AWCM Persistence is not correctly configured, devices may be bounced between different AWCM servers and cause enrollment failures or communication errors. The administrator should check and configure AWCM Persistence properly.

The step that would assist in troubleshooting this problem is using network traffic tools to capture Android traffic. Network traffic tools, such as Wireshark or Fiddler, can capture and analyze the network packets sent and received by the Android devices3. This can help identify any errors, delays, or anomalies in the communication between the devices and the console. Network traffic tools can also show the HTTP headers and body of the requests and responses, which can provide more information about the device status and configuration.

The log file that should be viewed is On the Device Services Server \Logs\Services\InterrogatorQueueService.log. InterrogatorQueueService.log is a log file that records the profile samples from devices and updates them in the Workspace ONE UEM console. Profile samples are data that show the status and details of profiles installed on devices. If profile status on multiple devices is not updating, it could indicate that there is a problem with InterrogatorQueueService configuration, connectivity, or performance. The administrator should view and analyze the InterrogatorQueueService.log file to identify and troubleshoot the issue.

The iOS specific requirement that should be reviewed is APNs certificate validity. APNs (Apple Push Notification service) certificate is a certificate that allows Workspace ONE UEM to communicate with iOS devices using push notifications. If the APNs certificate expires or becomes invalid, iOS devices will not be able to receive push notifications or check in with Workspace ONE UEM. The administrator should check and renew the APNs certificate if needed.

The root cause of this issue is that Workspace ONE Assist agent failed to connect to the Workspace ONE Assist server. The request timeout error indicates that the Workspace ONE Assist agent did not receive a response from the Workspace ONE Assist server within the specified time limit3. This could be due to network issues, firewall settings, or authentication problems. The administrator should check and resolve these issues to enable remote sessions using Workspace ONE Assist.

The possible cause of this problem is that VPP sToken has expired. VPP (Volume Purchase Program) sToken is a token that allows Workspace ONE UEM to communicate with Apple’s VPP service and manage purchased applications for iOS devices. If the VPP sToken expires or becomes invalid, Workspace ONE UEM will not be able to assign or distribute purchased applications to devices. The administrator should check and renew the VPP sToken if needed.