# Domain Posture Check Failure **URL:** \ **Category:** Uncategorized\ **Created:** [August 3, 2026, 8:19am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979 "2026-08-03T08:19:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![cao](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@cao](https://openziti.discourse.group/u/cao)\ **Post date:** [August 3, 2026, 8:19am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/1 "2026-08-03T08:19:52Z")
I'm running windows Edge Client 2.9.5 to access OpenZiti Overlay Network, it works well. I try to create a Posture Check OS System Check, it works well. I try to create a Posture Check with Domain check, BUT it doesn't work. 1. This is my posture check config > [https://controller.poc.net:1280/edge/management/v1/posture-checks/54qc5ku1XrCfKb1QNoy1cn](https://controller.poc.net:1280/edge/management/v1/posture-checks/54qc5ku1XrCfKb1QNoy1cn) > { > "name": "windows-domain-check", > "typeId": "DOMAIN", > "tags": {}, > "domains": [ > "**[apollo.workspace.poc.net](http://apollo.workspace.poc.net)**" > ] > } 1. > This is my dial policy > { > "name": "700644-legacy-sftp-dial", > "appData": "", > "serviceRoles": [ > "@3oUr7xpAPWVutdqWYjQVR6" > ], > "identityRoles": [ > "#700644-legacy-sftp-dial" > ], > "postureCheckRoles": [ > "@54qc5ku1XrCfKb1QNoy1cn" > ], > "semantic": "AnyOf", > "type": "Dial", > "tags": {} > } 2. > The identity used to run the edge client has below env info > "envInfo": { > "arch": "x86\_64", > "domain": "**[apollo.workspace.poc.net](http://apollo.workspace.poc.net)**", > "hostname": "1bd4c6da001", > "os": "MINGW32\_NT-10.0", > "osRelease": "10.0.26100", > "osVersion": "Windows 11 Enterprise" > }, 3. > The error log from the edge client shows > ERROR ziti-sdk:ziti\_ctrl.c:504 ctrl\_body\_cb() ctrl[[https://controller.poc.net:1280/\](https://controller.poc.net:1280/%5C)] API request[/sessions] failed code[INVALID\_POSTURE] message[Posture response data is missing or wrong] > WARN ziti-sdk:connect.c:476 connect\_get\_net\_session\_cb() conn2.80/z3XPalVQ/Connecting failed to get 'Dial' session for service[700644-legacy-sftp]: INVALID\_POSTURE(Posture response data is missing or wrong) > ERROR tunnel-cbs:ziti\_tunnel\_cbs.c:122 on\_ziti\_connect() ziti dial failed: failed posture check Please advise what could be the issue here. The identity envinfo shows domain matchs Posture check domain, why here posture check was failed? ---
**Author:** ![cao](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@cao](https://openziti.discourse.group/u/cao)\ **Post date:** [August 5, 2026, 1:44am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/2 "2026-08-05T01:44:32Z")
Hi experts, Anyone can provide some advices here, throw some hints here. much appreciated! ---
**Author:** ![andrew.martinez](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/andrew.martinez/32/540_2.png) [@andrew.martinez](https://openziti.discourse.group/u/andrew.martinez)\ **Post date:** [August 5, 2026, 2:26pm UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/3 "2026-08-05T14:26:49Z")
Hey there cao, Can you provide the following: - controller version - deployment model (single controller, multiple controllers) - logs showing the authentication portion from your client ( /authenticate or /oidc endpoints) ---
**Author:** ![cao](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@cao](https://openziti.discourse.group/u/cao)\ **Post date:** [August 6, 2026, 10:00am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/4 "2026-08-06T10:00:59Z")
Thanks andrew.martinez for looking into this. Here the the information. - OpenZiti: v1.6.13 - Windows Edge Client:V2.9.5 - Deploy Model: Single Controller and Single Router Windows Edge Client Logs during Authentication (OIDC): > [2026-08-06T09:39:05.072Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test\_user updated To {"Name":"test\_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"[https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":true,"ExtAuthProviders":["IDA-DEV](https://controller.poc.net:1280/%22,%22id%22:null,%22configTypes%22:null%7D,%22Status%22:null,%22Services%22:%5B%5D,%22Metrics%22:%7B%22TotalBytes%22:0,%22Up%22:0,%22Down%22:0%7D,%22ControllerVersion%22:%22v1.6.13%22,%22MfaEnabled%22:false,%22MfaNeeded%22:false,%22MfaMinTimeout%22:-1,%22MfaMaxTimeout%22:-1,%22MfaMinTimeoutRem%22:-1,%22MfaMaxTimeoutRem%22:-1,%22MinTimeoutRemInSvcEvent%22:-1,%22MaxTimeoutRemInSvcEvent%22:-1,%22MfaLastUpdatedTime%22:%220001-01-01T00:00:00%22,%22NeedsExtAuth%22:true,%22ExtAuthProviders%22:%5B%22IDA-DEV)"]} > [2026-08-06T09:39:05.902Z] INFO ZitiDesktopEdge.Models.ZitiIdentity beginning external auth using url: " [Home Realm Discovery](https://idadg2.jpmorganchase.com/adfs/oauth2/authorize/?client_id=PC-700644-SID-431636-DEV&scope=openid%20JPMC%3AURI%3ARS-700644-178258-Wicket-DEV%2FOpenid&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A20314%2Fauth%2Fcallback&code_challenge=cjWnTPRH3Ywq3WglskBWaW2nq-wnHbse-7TDDrcq4BI&code_challenge_method=S256&state=3OPHCNPZYnNKQGarJbpy1jnJVdTa_aAMil9FeWTk&audience=JPMC%3AURI%3ARS-700644-178258-Wicket-DEV) " > [2026-08-06T09:39:19.493Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test\_user updated To {"Name":"test\_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"[https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":false,"ExtAuthProviders":["IDA-DEV](https://controller.poc.net:1280/%22,%22id%22:null,%22configTypes%22:null%7D,%22Status%22:null,%22Services%22:%5B%5D,%22Metrics%22:%7B%22TotalBytes%22:0,%22Up%22:0,%22Down%22:0%7D,%22ControllerVersion%22:%22v1.6.13%22,%22MfaEnabled%22:false,%22MfaNeeded%22:false,%22MfaMinTimeout%22:-1,%22MfaMaxTimeout%22:-1,%22MfaMinTimeoutRem%22:-1,%22MfaMaxTimeoutRem%22:-1,%22MinTimeoutRemInSvcEvent%22:-1,%22MaxTimeoutRemInSvcEvent%22:-1,%22MfaLastUpdatedTime%22:%220001-01-01T00:00:00%22,%22NeedsExtAuth%22:false,%22ExtAuthProviders%22:%5B%22IDA-DEV)"]} > [2026-08-06T09:39:21.691Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test\_user posture change. is a posture check failing: False > [2026-08-06T09:39:21.718Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test\_user posture change. is a posture check failing: False > [2026-08-06T09:39:21.718Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test\_user updated To {"Name":"test\_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"[https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[{"Name":"700644-legacy-sftp","Protocols":["tcp"],"Addresses":[{"IsHost":true,"Hostname":"wh-13cd108dc1.svr.us.poc.net","IP":null,"Prefix":0}],"Ports":[{"High":2222,"Low":2222}],"OwnsIntercept":true,"AssignedIP":null,"PostureChecks":[{"IsPassing":true,"QueryType":"OS","Id":"6q8FejD31p4Of7uMC8kWn0"},{"IsPassing":false,"QueryType":"DOMAIN","Id":"54qc5ku1XrCfKb1QNoy1cn"},{"IsPassing":true,"QueryType":"PROCESS","Id":"2DwjeqOfiUb5q9DRdutVU3"}],"IsAccessible":false,"Timeout":-1,"TimeoutRemaining":-1,"Permissions":{"Bind":false,"Dial":true}}],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":false,"ExtAuthProviders":["IDA-DEV](https://controller.poc.net:1280/%22,%22id%22:null,%22configTypes%22:null%7D,%22Status%22:null,%22Services%22:%5B%7B%22Name%22:%22700644-legacy-sftp%22,%22Protocols%22:%5B%22tcp%22%5D,%22Addresses%22:%5B%7B%22IsHost%22:true,%22Hostname%22:%22wh-13cd108dc1.svr.us.poc.net%22,%22IP%22:null,%22Prefix%22:0%7D%5D,%22Ports%22:%5B%7B%22High%22:2222,%22Low%22:2222%7D%5D,%22OwnsIntercept%22:true,%22AssignedIP%22:null,%22PostureChecks%22:%5B%7B%22IsPassing%22:true,%22QueryType%22:%22OS%22,%22Id%22:%226q8FejD31p4Of7uMC8kWn0%22%7D,%7B%22IsPassing%22:false,%22QueryType%22:%22DOMAIN%22,%22Id%22:%2254qc5ku1XrCfKb1QNoy1cn%22%7D,%7B%22IsPassing%22:true,%22QueryType%22:%22PROCESS%22,%22Id%22:%222DwjeqOfiUb5q9DRdutVU3%22%7D%5D,%22IsAccessible%22:false,%22Timeout%22:-1,%22TimeoutRemaining%22:-1,%22Permissions%22:%7B%22Bind%22:false,%22Dial%22:true%7D%7D%5D,%22Metrics%22:%7B%22TotalBytes%22:0,%22Up%22:0,%22Down%22:0%7D,%22ControllerVersion%22:%22v1.6.13%22,%22MfaEnabled%22:false,%22MfaNeeded%22:false,%22MfaMinTimeout%22:-1,%22MfaMaxTimeout%22:-1,%22MfaMinTimeoutRem%22:-1,%22MfaMaxTimeoutRem%22:-1,%22MinTimeoutRemInSvcEvent%22:-1,%22MaxTimeoutRemInSvcEvent%22:-1,%22MfaLastUpdatedTime%22:%220001-01-01T00:00:00%22,%22NeedsExtAuth%22:false,%22ExtAuthProviders%22:%5B%22IDA-DEV)"]} > [2026-08-06T09:39:35.802Z] INFO ZitiDesktopEdge.MainMenu opening service logs at: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\service\ziti-tunneler.log.202608060000.log > [2026-08-06T09:39:36.207Z] INFO ZitiDesktopEdge.MainMenu showing service logs. file: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\service\ziti-tunneler.log.202608060000.log > [2026-08-06T09:47:57.102Z] INFO ZitiDesktopEdge.MainMenu opening UI logs at: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\UI\ZitiDesktopEdge.log > [2026-08-06T09:47:57.527Z] INFO ZitiDesktopEdge.MainMenu showing UI logs. file: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\UI\ZitiDesktopEdge.log ---
**Author:** ![cao](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@cao](https://openziti.discourse.group/u/cao)\ **Post date:** [August 6, 2026, 10:30am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/5 "2026-08-06T10:30:03Z")
Adding Windows Version as well. OS Name: Microsoft Windows 11 Enterprise OS Version: 10.0.26100 N/A Build 26100 ---
**Author:** ![cao](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@cao](https://openziti.discourse.group/u/cao)\ **Post date:** [August 7, 2026, 6:59am UTC](https://openziti.discourse.group/t/domain-posture-check-failure/5979/6 "2026-08-07T06:59:23Z")
After read the source code, it turns out that this cloud be potential bug. There are two different code path for the DOMAIN infomation and returns different value. - Identity envinfo.domain uses GetComputerNameExA, gives full FQDN [apollo.workspace.poc.net](http://apollo.workspace.poc.net) - Posture Check Domain info uses NetGetJoinInformation,give short name apollo I config the Posture Check from Identity's envinfo.domain which doesn't match Posture check domain. Change it to the short name apollo solve the issue. I think this two code path need to be conslidated so that both return same consistent domain name. Otherewise this behavior should be clearly documented in the Posture Check user guide, so that people can config the domain name correctly.