AppProfileSafe - Support Portal

License Troubleshooting

This page lists common license validation errors and how to resolve them. All license errors are displayed as a dialog in the GUI and return exit code 3 in CLI mode. Detailed error information is written to the application log.


Error Messages and Solutions

Error Message Cause Solution
"No valid license is present." License.json does not exist at the configured path. Deploy License.json to the license folder. Check the <LicenseFilePath> setting in settings.xml. Default: %ProgramData%\IT-Consulting Kinner\AppProfileSafe\License\License.json
"The public key for license verification is missing." AppProfileSafe.pem does not exist at the configured path. Deploy the public key file. Check the <PublicKeyPemPath> setting. This file is included in the installation package.
"The license file is invalid or the signature does not match." The JSON could not be parsed, the SubscriptionEndDateUtc is malformed, or the RSA-PSS signature does not match the license data. Ensure the License.json has not been modified after signing. Obtain a fresh license file. Check the application log for the specific underlying error (LICENSE_JSON_INVALID or LICENSE_SIGNATURE_CHECK_FAILED).
"License expired more than 30 days ago." The subscription end date is more than 30 days in the past — beyond the grace period. Obtain and deploy a renewed license. See Installing or Updating a License.
"License check failed: AD-DNS-Domain is not matching." The machine's AD domain does not match the LicensedDomainOrTenant value in the license. Verify the machine is joined to the licensed domain. The match uses dot-separated suffix matching — a license for contoso.com covers sub.contoso.com. Check the log entry LICENSE_AD_DOMAIN_MISMATCH for the detected vs. expected domain.
"License check failed: TenantID is not matching." The Azure AD tenant ID detected on the machine does not match the licensed GUID. Verify the machine is registered with the correct Azure AD tenant. Run dsregcmd /status and check the TenantId field. Compare with the LicensedDomainOrTenant in License.json.
"License check failed: TenantID could not be resolved." The machine is not Azure AD joined, or dsregcmd did not return a tenant ID. Ensure the machine is Azure AD joined or hybrid-joined. If the license uses a domain name instead of a GUID, this error should not occur — contact your license administrator.
"License check failed: AD-DNS-Domain could not be determined." The machine is not domain-joined, or the domain name could not be resolved. Ensure the machine is joined to an Active Directory domain. For workgroup machines, use a license bound to an Azure tenant ID instead.


General Troubleshooting Checklist

  1. Open the application log (app.csv) and search for LicenseValidator entries to find the specific error.
  2. Verify that License.json exists at the expected path. Open the file and confirm the JSON is well-formed.
  3. Verify that AppProfileSafe.pem exists at the expected path.
  4. Check the SubscriptionEndDateUtc in the license file — is it still in the future or within the 30-day grace period?
  5. For domain binding: run echo %USERDNSDOMAIN% to check the machine's AD domain.
  6. For tenant binding: run dsregcmd /status and look for the TenantId value.
  7. Ensure the License.json file has not been manually edited — any modification invalidates the signature.


GUI Falls Back to Trial Mode

In the GUI, most license validation failures (except hard expiry) cause the application to start in trial mode instead of exiting. If you see the Dashboard with a red "Test Mode" License tile, the license validation failed but was not fatal. Check the application log for the specific reason and deploy a valid license. See How Licensing Works for details on trial mode limitations.