Collector Enrollment Failed
A newly installed collector did not complete enrollment: the token was rejected, expired or revoked, or the host could not reach the AssurIQ control plane.
Updated Sep 2, 2026collectorenrollmenttroubleshooting
- Trigger
- A collector stays in Enrollment Pending past the token expiry, or the installer reports AIQ-ENR-001 through AIQ-ENR-004.
- Risk
- No operational risk to the customer environment, but the site has no discovery or evidence collection until enrollment succeeds; onboarding timelines slip and the token may need to be reissued.
Prerequisites
- Access to the AssurIQ Collector Center for the customer/site
- Local or remote administrative access to the collector host
- Knowledge of any proxy or egress filtering between the host and the internet
Recommended fix
- Read the installer or service log for the AIQ-ENR code and match it to the cause below.
- AIQ-ENR-001 (invalid/used): tokens are single-use. Issue a fresh token from the collector record and rerun the installer; never reuse a token captured from an earlier attempt.
- AIQ-ENR-002 (expired): tokens are short-lived by design. Issue a new token immediately before running the install command.
- AIQ-ENR-003 (revoked): confirm with the team member who revoked it, then issue a new token if the deployment is still authorized.
- AIQ-ENR-004 (unreachable): verify outbound HTTPS 443 to the control plane URL, proxy settings and TLS inspection exclusions, then retry.
- Confirm the collector transitions from Enrollment Pending to Healthy and the token record shows Used.
Validation
- Collector state is Healthy with a first-enrolled timestamp
- The bootstrap token shows Used and a permanent credential is present
- Initial Discovery can be started from the collector page
Rollback and recovery
- Revoke any outstanding unused tokens for the collector record so they cannot be replayed later.
Evidence generated
- Enrollment audit events (token issued, token used/rejected, credential issued)
- Collector host facts captured at enrollment
Related controls
Related docs
- Enrollment failuresSymptom-first guide for AIQ-ENR-001 through AIQ-ENR-004: token, expiry, revocation and connectivity failures during enrollment.
- Firewall and egress requirementsThe collector is outbound-only. What to allow, on which ports, and why no inbound rules are ever needed.
- Proxy configurationRoute collector traffic through an explicit or PAC-defined proxy without breaking mTLS.