Windows ziti-edge-tunnel returns posture state was nil for Process Checks (OS Check works fine)

Tunneler Apps Ziti Desktop Edge for Windows
1

Hi everyone!,

Hope anyone can help me because i've been pulling my hair for hours and can't find the issue (most probably myself).

I'm trying to implement a simple running process posture check in windows, the client consistently returns nil, no matter all the combinations i've tried (just process, multi process, running the process as admin, without admin rights, adding SHA256 validation, without it, adding full path, adding just the process name, using forward slashes, backwards slashes, simple or double, etc) the message is always the same

ERROR ziti-sdk:connect.c:1094 connect_reply_cb() conn1.23/R57YxZWX/Connecting failed to connect, reason=1 policies failed: policy RDP-dial-policy [ftMzr49XcfatacFzZiMH2] failed due to 1 error(s): posture check my-proc-multi [sOG8jLDCWgmPqmvgkWwb2] failed due to error(s): posture state was nil, no posture data has been sent

Info:

Controller/Router version 2.0 / ZAC 4.2.0

Windows client, using ziti-edge-tunnel 1.17.0

Target process: notepad.exe (used c:\windows\system32\notepad.exe aswell in my tests)

Already tried: permissions (admin and not admin), disabling my security software, adding ziti-edge as an exception, creating the posture via ZAC and via command line, pasting the JSON intead of using the selectors and all i can think of.

Also, as a side note, the mac check is acting weird aswell, adding the posture check via ZAC automatically adds the colons, but the check fails is because its without them?

posture check MAC_CHECK [3gnrI9tBxiVTATEQX8GZ8a] failed due to error(s): none of the given values were in the valid values, given: [xx:xx:xx:xx:xx:xx], valid: [xxxxxxxxxxxx]

I can also confirm that using another posture check, OS version, works beautifully, so i'm officially lost.

Would appreciate any insight on what i'm doing wrong and/or why the process engine is not detecting the active process.

Much appreciated in advance.

2

Hi @ImFeelingBetter, welcome to the community and to OpenZiti! I must apologize I totally forgot to reply to your issue here!

I'll try to replicate your problem. Are you using the default auth policy?

3

Hi!, no need to apologise, i'm the one that's asking a question probably based on a mistake i made.

Yeah, i think so, i created a simple identity, enrolled it, then created a simple RDP service using the "Simple" wizard, it created all the service policies and i just added the check on the dial-policy.

Auth Policy wasn't touched, still is "default", cert, ext jwt, updb and expired certificates enabled.
What's puzzling, for me, is that the OS version check works amazing.

4

I spent a fair bit of time recreating the problem and trying to track it down only to learn that this appears to be a 2.0+ issue (well, 'oidc' moreso than 2.0 but that was a big 2.0 change). I have filed an issue you could track at process-related posture checks don't work with 2.0+ · Issue #3980 · openziti/ziti · GitHub

Thanks for letting us know!

5

Thanks Clint, i'm awfully sorry for having taken your time. Appreciate the creation of the issue.

6

Just checking, i'm testing version 2.0.2, is there a chance that this still doesn't work?

[2026-08-19T23:31:01.854Z] ERROR tunnel-cbs:ziti_tunnel_cbs.c:128 on_ziti_connect() ziti dial failed: connection is closed
[2026-08-19T23:31:02.374Z] ERROR ziti-sdk:connect.c:1098 connect_reply_cb() conn1.53/oE0IOLRT/Connecting failed to connect, reason=1 policies failed: policy RDP-dial-policy [3iOFaxUJzNih0iJKveUssE] failed due to 1 error(s): posture check Test-TG [VuJ24Q2NyX1iLrgzJSltH] failed due to error(s): one valid values is required, got 0, have: Path:"C:\Users\OEM\Documents\Telegram\Telegram.exe" Hashes:"c5c855cb2c1acb7f421544fb179a9e9ca13d95c07df00d29ccf481ebc685a503533fbc898e7735c02b5e8264ec712fcd8c0cb33937289f45e1ee8469914b235c", failed for: [the state did not match because os types do not match, given , expected: Windows, expected: OsType:"Windows" Path:"C:\Users\OEM\Documents\Telegram\Telegram.exe", given: <nil>]

-- Weirdly the client logs state the process is running

[2026-08-19T23:39:18.316Z]   DEBUG tunnel-sdk:tunnel_tcp.c:116 new_tcp_pcb() snd_wnd: 65535, snd_snd_max: 65535, mss: 16382
[2026-08-19T23:39:18.316Z]   DEBUG tunnel-sdk:tunnel_tcp.c:436 recv_tcp() intercepted address[tcp:100.64.0.3:3389] client[tcp:100.64.0.1:58365] service[RDP]
[2026-08-19T23:39:18.316Z]   DEBUG tunnel-cbs:ziti_tunnel_cbs.c:392 ziti_sdk_c_dial() service[RDP] app_data_json[175]='{"connType":null,"dst_protocol":"tcp","dst_hostname":"pctest.localhost.localdomain","dst_ip":"100.64.0.3","dst_port":"3389","src_protocol":"tcp","src_ip":"100.64.0.1","src_port":"58365"}'
[2026-08-19T23:39:18.316Z]   DEBUG ziti-sdk:connect.c:444 connect_get_service_cb() conn1.57/lfUNKp9_/Connecting got service[RDP] id[32YotaNK3Do3usMAGVSczP]
[2026-08-19T23:39:18.316Z]   DEBUG ziti-sdk:posture.c:219 ziti_send_posture_data() ztx[1] posture checks must_send set to FALSE, new_session_id[FALSE], must_send_every_time[FALSE], new_controller_instance[FALSE]
[2026-08-19T23:39:18.316Z]   DEBUG ziti-sdk:connect.c:568 process_connect() conn1.57/lfUNKp9_/Connecting starting Dial connection for service[RDP] with session[cmt0q68wv9t4nfvn748g14kyr]
[2026-08-19T23:39:18.316Z]   DEBUG ziti-sdk:connect.c:421 ziti_connect() conn1.57/lfUNKp9_/Connecting selected ch[edge-router] for best latency(4 ms)
[2026-08-19T23:39:18.316Z]   DEBUG ziti-sdk:channel.c:307 ziti_channel_add_receiver() ch[0] added receiver[57]
[2026-08-19T23:39:18.326Z]   DEBUG ziti-sdk:posture.c:1232 check_running() is running result: true for C:\Users\OEM\Documents\Telegram\Telegram.exe
[2026-08-19T23:39:18.332Z]   ERROR ziti-sdk:connect.c:1098 connect_reply_cb() conn1.57/lfUNKp9_/Connecting failed to connect, reason=1 policies failed: policy RDP-dial-policy [3iOFaxUJzNih0iJKveUssE] failed due to 1 error(s): posture check Test-TG [VuJ24Q2NyX1iLrgzJSltH] failed due to error(s): one valid values is required, got 0, have: Path:"C:\Users\OEM\Documents\Telegram\Telegram.exe" Hashes:"c5c855cb2c1acb7f421544fb179a9e9ca13d95c07df00d29ccf481ebc685a503533fbc898e7735c02b5e8264ec712fcd8c0cb33937289f45e1ee8469914b235c", failed for: [the state did not match because os types do not match, given , expected: Windows, expected: OsType:"Windows" Path:"C:\Users\OEM\Documents\Telegram\Telegram.exe", given: ]
[2026-08-19T23:39:18.332Z]   DEBUG ziti-sdk:connect.c:338 complete_conn_req() conn1.57/lfUNKp9_/Disconnected Disconnected failed: connection is closed
[2026-08-19T23:39:18.332Z]   ERROR tunnel-cbs:ziti_tunnel_cbs.c:128 on_ziti_connect() ziti dial failed: connection is closed
[2026-08-19T23:39:18.332Z]   DEBUG ziti-sdk:connect.c:200 close_conn_internal() conn1.57/lfUNKp9_/Closed removing
7

Hi @ImFeelingBetter - the issue isn't closed yet so I don't believe it's resolved.