Login or two-factor verification fails
Identify whether the rejection concerns the password, network policy, current authenticator code or protected server key.
Recognize the symptom
The password is rejected, a valid-looking authenticator code fails, or access stops after a migration or restore. Record the stage and exact message without recording secrets. Repeated guessing can activate temporary limits and make the original problem harder to distinguish.
Possible causes
Possible causes include an inactive account, changed credentials, network restrictions, device clock drift or an obsolete recovery code. After server work, missing or unreadable protected 2FA key material can prevent decryption of existing associations. This differs from simply entering an expired one-time code.
Check before changing anything
Check username and account status with the administrator, then consult the Access log and applicable network rule. For 2FA, synchronize device time and use the correct Obelisk authenticator entry. If the failure began after a restore, check preservation and permissions of the configured server key.
Take a targeted action
Use an unused recovery code when the authenticator is unavailable, or follow the supported administrator-assisted recovery. Restore the actual protected key from the appropriate backup if that is the confirmed failure. Do not delete the key or user records to force fresh enrollment.
Verify the result
Test one fresh login and inspect the account’s 2FA state. After configuration restore, existing authenticator associations remain valid but previous recovery codes are invalidated: generate and protect a new set. Verify the recovered account keeps its intended permissions rather than leaving elevated temporary access.