Failed Validation Troubleshooting

Overview

AIQ-RMD-005 means the remediation job executed without error, but the post-check that should confirm the fix did not pass. This is different from a job failure: the change was applied, but AssurIQ has not yet observed evidence that it worked.

Decision tree

1. Pending reboot: check whether the target requires a restart to complete the change. Many patches and configuration changes do not take effect until reboot, and validation will correctly fail until then.
2. Superseded patch: confirm the specific patch or update is still the current one for that platform. Vendors sometimes supersede a patch after a job was queued; the applied update may already be replaced.
3. Source not re-synced: confirm the underlying data source (vulnerability scanner, patch management connector, configuration collector) has completed a fresh cycle since the job ran. Validation checks current evidence, not the job's own success signal.
4. Wrong target: confirm the job targeted the correct asset. This is more common than expected in environments with similarly named hosts or recently reimaged machines.
5. Control cadence: confirm the associated control's evaluation cadence has actually elapsed. A control checked every 24 hours will not reflect a fix applied 10 minutes ago.

Reading step logs

Open the job in Fix Center and expand each step. Steps run in order: pre-check, apply, and post-check. A validation failure with a clean apply step means the change was made but the evidence has not yet confirmed it; a validation failure alongside a warning on the apply step usually means the change was only partially applied.

Re-running validation

Once a pending reboot has completed or the source has re-synced, re-run validation directly from the job without re-applying the fix. This re-evaluates the control against the latest evidence without repeating the change itself.

Rollback criteria

Roll back only when the applied change caused a regression — for example, a service failing to start, a device losing connectivity, or a broken dependency — not simply because validation has not yet confirmed success. Rolling back a correctly applied fix just because evidence hasn't caught up removes the very change that will make the next validation pass.

Evidence is generated even on failure

Reference

• AIQ-RMD-005Validation failed
  The remediation job ran but the post-check did not confirm the fix.
• AIQ-RMD-001Remediation job failed
  A job step returned a non-zero result or timed out.

• Validation and Re-scan
  How jobs prove the fix worked and update control state.
• Rollback
  When rollback is available and what it restores.
• Remediation Center
  Work queue, SLAs, ownership and how items flow into Fix Center jobs.