Caisey Blog

MSP ยท May 22, 2026

Caisey Caught Itself Running as the Wrong User Mid-Fix

Outlook WAM error 0x80070520. Caisey parsed dsregcmd, caught itself running as SYSTEM, queried quser to find the user's profile, cleared the IdentityCache, and handed me ticket notes. Hit approve, done in 7 min.

End user couldn't authenticate Outlook. Tech opened Caisey and asked it to run dsregcmd /status against the user's profile. The output was a wall of text. Caisey pulled out the smoking gun in seconds: WamDefaultSet : ERROR (0x80070520) Translation: "A specified logon session does not exist. It may already have been terminated." The Windows Account Manager's token cache was either corrupt or pointed at a dead session. Classic root cause for modern Outlook auth failures. Before recommending anything, Caisey asked the right question: was this machine supposed to be Hybrid Azure AD joined, or was the user just cloud-only? Different problem, different fix. The tech confirmed cloud-only. Caisey moved on. The tech tried certutil -DeleteHelloContainer next. It failed with 0x80090011 (NTE_NOT_FOUND). No Hello container existed on the profile. Where a junior tech might have spiraled into "wait, why did this fail?", Caisey read it for what it was: nothing to clear, move on. It pivoted directly to a WAM/IdentityCache/TokenBroker cleanup. Then came the moment worth paying attention to. The tech approved the cleanup. Caisey ran Remove-Item against $env:LOCALAPPDATA. The paths didn't exist. Instead of spinning on the error, Caisey diagnosed itself: it was running under the agent's service context, not the interactive user's session. %LOCALAPPDATA% was resolving to the wrong profile. So it ran quser, identified the active console user, pulled their actual profile path from WMI, and re-targeted the cleanup at the correct AppData\Local. Cleared IdentityCache. Confirmed WAM and TokenBroker\Cache weren't present. Told the tech: no reboot needed. Just fully close Outlook (verify the process exits in Task Manager), reopen, let it prompt for sign-in. The WAM error resolves on re-auth. When the tech asked for ticket notes, Caisey produced a clean writeup with error codes, paths cleared, next steps, and follow-up criteria. Ready to paste straight into the PSA. Total session time: about seven minutes from open to ticket notes. The interesting part isn't that Caisey knew what 0x80070520 meant. Plenty of techs know that, and the rest can Google it. The interesting part is what happened when its own command failed because it was running under the wrong user context. It caught the problem, switched diagnostic strategies, and routed around it without the tech having to say "wait, you're running as SYSTEM, find the user's profile path." That's the step a senior tech does automatically and a junior tech doesn't think to do at all. Caisey is a co-pilot. The tech approved every action. But the difference between "five minutes of guided cleanup with an audit trail attached" and "twenty minutes of manual error-code lookups, registry hunting, and ticket notes written by hand" is exactly what the tool is for. Want to see how it handles your stack?