Help › Manage › G20

Understand why a device was rejected when signing in

If the relay rejects a device, the console shows it — with the reason and the next step. This is how you get the device back and acknowledge the message.

Preview this guide has not yet been clicked through on a real device. Button names and steps come from the program but may differ in details.

For: Account administrator
Applies to: Free · Cloud · Own relay
Right in the console: Viewing: any account that can see the access; acknowledging and resetting a certificate: administrators only
Controlled device: Windows · macOS · Linux
Control from: Browser
from version: 20261010.3

What it is for

A device shows as "offline" in the console although it is running? Often the relay rejected it when it signed in — for example because its proof for the access is no longer valid or its certificate does not match. The console shows every such rejection with the reason and the next step. This page explains where you see it and what to do for each reason.

What you need

A console account that can see the access (the console calls it "tenant").
To acknowledge and to reset a certificate: administrator rights.

How to do it

Overview: in the console StartOverview. Under Needs attention you see Devices rejected at registration (24 h) with the count. The line expands into a list: per device a short reason, name, access, time, attempts and, under What to do:, the next step.
Device list: under FleetDevices a rejected device shows the red state Rejected — the reason appears when you hover over it.
Device: Open device (from the overview) or click the device in the list. Below the name it says in red since when and why it is rejected.
Fix it — depending on the reason (table below).
Acknowledge: when it is done, or the device was removed on purpose, click Acknowledge in the overview. If the device is rejected again later, it shows up again.

Reasons and what to do

Short reason in the console	What is behind it	What you do
Proof for the access invalid	The device's membership is no longer valid — expired, revoked, or invalidated by a new password of the member account it joined with (H23).	Add the device to the access again, most easily with a one-time code (C2). The "What to do:" sentence names "Zugang beitreten" (join access); on the device the way is EinstellungenFernzugriff (Settings > Remote access) → card Zugang (Access) → Beitreten (Join) or Mit Code hinzufügen (Add with code).
Unknown access	The device signs in to an access that does not (or no longer) exist on the relay. It is then not in the device list, only in the overview.	Join an existing access on the device (C2).
Device certificate missing	The relay requires a device certificate and the device does not present one — typically after a reinstall or a restored image, or a move to another access is still pending.	In the device: Reset certificate. On your own relay also SettingsDevice certificates (mTLS) → Enrollment requests → Approve.
Device certificate rejected	The certificate has expired, been revoked or was issued for another access.	In the device: Reset certificate; the device then fetches a new one.
Device blocked	The device is blocked in the console.	In the device or the device list: Unblock (the "What to do:" sentence says "Sperre aufheben" (lift the block) — the button is Unblock).
License exhausted	The relay's licence is not enough or has expired. There is also the separate line Devices refused by the licence (24 h).	Extend or renew the licence (A7).
All seats of the access taken	All seats of the access are taken.	Free a seat or buy more (C7, A7).

How you know it worked

The device signs in again within a few minutes — it retries about every two minutes. It is then online and disappears from the list under Needs attention; a successful sign-in clears the rejection.
After Acknowledge the console reports "Rejection acknowledged."

Good to know

A proof of its own per device (from 20261010.3): a device with the service or a machine-wide sign-in receives a proof bound to the device when it signs in (365 days, renewed automatically). From then on it no longer depends on the password of the account it joined with. For this the host restarts once briefly — that is intended.
Update the devices first, then change passwords. When you change the password of a member account, the console asks first and names the devices that still depend on that account (B5).
Revoke device certificate (right-click in the list) is not the same: for a rejected device, Reset certificate is the right button.
Device deleted? Deleting it clears the rejection too. An older message about a deleted device says "The device is not (or no longer) in the device list. …" — just acknowledge it.
What the technician sees when connecting to a device that is not signed in: D9.
Blocked or removed: KB article Block a device or remove it from management.

If it does not work

You see	Meaning and remedy
Acknowledge is missing	Your account has no administrator rights.
The device is still rejected after resetting	BrowserDesk is not running on the device, or it signs in under another access. Check on the device: EinstellungenFernzugriff → card Zugang.
The rejection Proof for the access invalid returns about 24 hours after a move	A known bug on devices without the service, fixed from version 20261011.25. Update the device — the new version also heals devices that were already moved.
A whole access is suddenly offline	Usually a new password on the member account (H23). Add the devices again with a one-time code.

← Connect other programs — API tokens and webhooks Read the console overview — tiles, needs attention, cards →