Fix: Token Authentication Rejected (AGENT-1002)
Edit ArticleResolving 401 Unauthorized errors and re-registering client device tokens.
Sentinel Operations Team
4 min read
Updated August 28, 2026
v3.2Diagnosed Problem
Agent service connects to server, but heartbeats and telemetry are rejected with "401 Unauthorized - Invalid Device Token".
Visible Symptoms
- Console displays red error icon on device row.
- Log shows: "Registration token rejected by server".
Possible Root Causes
- Device record was manually deleted or archived in the Sentinel Console.
- Computer was cloned from a master VM image that already contained a registered token.
- Organization license key was regenerated.
Step-by-Step Resolution Procedure
1Stop the Sentinel Service
Stop the background agent service.
powershell
1Stop-Service SentinelAgent
2Delete the Stale DPAPI Token
Remove registration.dat to force a clean re-enrollment.
powershell
1Remove-Item "C:\ProgramData\Sentinel\registration.dat" -Force
3Start Service to Re-Register
Start the service. The agent will re-register as a fresh device within 10 seconds.
powershell
1Start-Service SentinelAgent
How to Verify the Fix:Verify in "C:\ProgramData\Sentinel\logs\" that "Device registration successful: 200 OK" is recorded.
Technician Verification Command:
powershell
1Test-Path "C:\ProgramData\Sentinel\registration.dat"
Tags:#AGENT-1002#Token Error#Registration
Was this documentation page helpful?
Your technician feedback helps our team continuously improve Sentinel guides.