[Windows 10/11] How to get a clean installation of Barrier? One specific client+User combo keeps failing to connect to the server.

[llinfeng]

Preamble

I have the following configuration, where monitor A1-A5 all belong to my workstation machine as the server. Two clients are Surface 7, for note-taking with OneNote; and T480, for joining Zoom meetings without taking a toll on the workstation.

#######################################
# A1-A4: 1200x1920                    #
#                                     #
#                        +---------+  #
#+-----+-----+-----+-----|         |  #
#|     |     |     |     |  A5     |  #
#+ A1  + A2  + A3  + A3  +---------+  #
#|     |     |     |     |            #
#+-----+-----+-----+-----+--------+   #
#        | Surface7 |     | T480  |   #
#        +----------+     +-------+   #
#######################################

With the setup explained, here is what bugged me for long - after updating from v2.3.3 to either v2.3.4 or v2.4.0, I can no longer get the Surface 7 client to work. The closest I can get is the following log:

Click to expand debug log

[2022-04-02T15:27:34] DEBUG1: connecting to server
[2022-04-02T15:27:37] DEBUG: Closing socket: EE1A1010
[2022-04-02T15:27:37] DEBUG1: connection failed
[2022-04-02T15:27:37] WARNING: failed to connect to server: Connection was refused
[2022-04-02T15:27:37] DEBUG: retry in 1 seconds
[2022-04-02T15:27:38] NOTE: connecting to '196.168.0.XX': 196.168.0.XX:24800
[2022-04-02T15:27:38] DEBUG: Opening new socket: EE177530
[2022-04-02T15:27:38] INFO: OpenSSL 1.0.2l  25 May 2017
[2022-04-02T15:27:38] DEBUG1: openSSL : compiler: cl  /MD /Ox -DOPENSSL_THREADS  -DDSO_WIN32 -W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DOPENSSL_USE_APPLINK -I. -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPENSSL_NO_SSL2 -DOPENSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_WEAK_SSL_CIPHERS -DOPENSSL_NO_STATIC_ENGINE    
[2022-04-02T15:27:38] DEBUG1: openSSL : built on: reproducible build, date unspecified
[2022-04-02T15:27:38] DEBUG1: openSSL : VC-WIN64A
[2022-04-02T15:27:38] DEBUG1: OPENSSLDIR: "C:\OpenSSL/ssl"
[2022-04-02T15:27:38] DEBUG1: connecting to server
[2022-04-02T15:27:41] DEBUG: Closing socket: EE177530
[2022-04-02T15:27:41] DEBUG1: connection failed
[2022-04-02T15:27:41] WARNING: failed to connect to server: Connection was refused
[2022-04-02T15:27:41] DEBUG: retry in 1 seconds
[2022-04-02T15:27:42] NOTE: connecting to '196.168.0.XX': 196.168.0.XX:24800
[2022-04-02T15:27:42] DEBUG: Opening new socket: EE1A1190
[2022-04-02T15:27:42] INFO: OpenSSL 1.0.2l  25 May 2017
[2022-04-02T15:27:42] DEBUG1: openSSL : compiler: cl  /MD /Ox -DOPENSSL_THREADS  -DDSO_WIN32 -W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DOPENSSL_USE_APPLINK -I. -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPENSSL_NO_SSL2 -DOPENSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_WEAK_SSL_CIPHERS -DOPENSSL_NO_STATIC_ENGINE    
[2022-04-02T15:27:42] DEBUG1: openSSL : built on: reproducible build, date unspecified
[2022-04-02T15:27:42] DEBUG1: openSSL : VC-WIN64A
[2022-04-02T15:27:42] DEBUG1: OPENSSLDIR: "C:\OpenSSL/ssl"
[2022-04-02T15:27:42] DEBUG1: connecting to server

I have jumped through a number of hoops, including:

1. Get v2.3.4 first, keep the %APPDATA%/Barrier/SSL folder with the .pem file, and re-install v2.4.0. (I suppose this is equivalent to generating the .pem file directly using openssl command on an arbitrary *NIX systems. For example, with WSL, the well-known command works. openssl req -x509 -nodes -days 365 -subj /CN=Barrier -newkey rsa:4096 -keyout Barrier.pem -out Barrier.pem)
2. Remove all barrier.xxx file in c:\users\username\AppData\Local\Temp\, and restart both the service and the barrier.exe desktop client.
3. As the last attempt before reinstalling Windows on the Surface 7 tablet, I created a test local account, and configured Barrier afresh. This time, upon restarting both services + client on both the server and the Surface 7 tablet, well, my old configuration finally works!
   [Update a couple of months later - ever since this test-account remedy, the setup continues to run until now | 2022-05-24]

---

I assume my frustration, where one specific client+user combination keeps getting "banned" by the server, may have to do with two things:

1. Somewhere on the server machine, may there be legacy settings that keep refusing the specific client+user combination from connecting to the server? (Thus, on the client side, I see the repeated logs suggesting that "Connection was refused".)
2. Somewhere on the client machine, for the specific user profile, either the firewall setting is banning that specific user to access the remote port 24800 on the server, or that some legacy Barrier setting injected the connection again.

By now, there are for sure something left over on both the server and the client - after reinstalling Barrier (v2.3.4 or v2.4.0 alike), there is no welcome screen prompting me to confirm the language and server/client setting upon launching the client for the first time. Further, when new SSL certificates get added to the clients, with the existing Windows user account, there is no confirmation of the signatures when the "new" clients gets added on the server.

---

Question

By this point, I think it suffices to ask - how to do a clean installation of Barrier without redoing the Windows OS afresh? Specifically, what's left over after removing the program and all the %APPDATA%/Local/Barrier/ contents?

[jmcutler]

Here is what I know of for Windows so far:

%ProgramFiles%\Barrier
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Barrier.lnk

HKEY_LOCAL_MACHINE\SOFTWARE\Barrier
HKEY_CURRENT_USER\SOFTWARE\Debauchee
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\Barrier
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Services\Barrier
%ProgramData%\Barrier
%UserProfile%\AppData\Local\Barrier
%UserProfile%\AppData\Local\Temp\Barrier.*

[llinfeng]

Thanks a lot for the comprehensive list. I'll give it a try next time I troubleshoot Barrier :) Though, ideally, I don't have to do it very soon.

[Edit a day later] - Deleting HKEY_CURRENT_USER\SOFTWARE\Debauchee saved me day :) Thanks a lot!