iCloud for Windows 15.10.39.0 cannot sign in: AKValidateAppleIDCredentials
returns -7005 / "Verification Failed - There was an error connecting to the
Apple Account server", reproducible on a clean install.
ENVIRONMENT
iCloud for Windows version : 15.10.39.0 (Store/MSIX build, package family AppleInc.iCloud_nzyj5cx40ttqa, app version string "iCW Version 15.10.0.39(file version 610.6.0.24)")
Windows: Windows 11 26H2, build 10.0.26300.9711, x64
Installed via: Microsoft Store
Locale / timezone: en-HK / HKT
Account setting: Advanced Data Protection is NOT enabled
STEPS TO REPRODUCE
1. Install iCloud for Windows 15.10.39.0 from the Microsoft Store.
2. Launch iCloud, reach the "Connect to iCloud" onboarding page.
3. Enter the Apple ID and password and click Sign-In.
4. Wait ~3 seconds.
ACTUAL RESULT
A dialog appears:
Verification Failed
There was an error connecting to the Apple Account server.
The iCloudHome log records:
ConnectToiCloudPage::InitiateLogin Validating credentials ...
AKWinUIProvider::PresentLoginAlert AuthKit needs to show a login alert
(There was an error connecting to the Apple Account server.,
Verification Failed)
ConnectToiCloudPage::InitiateLogin Credential validation finished
abnormally...
FeedbackSender::ReportLoginAttempt errorCode=-7005,
extendedErrorCode=-7005, ... httpErrorCode=200 ssoAppType=2
ConnectToiCloudPage::InitiateLogin AKValidateAppleIDCredentials
returned -7005
Note on that log line: the serverErrorCode / httpErrorCode /
piggybackErrorCode / fidokeyErrorCode / anisetteErrorCode fields are
uninitialized junk in this build - three of them decode to the ASCII string
"default" cast to an integer (e.g. 28258988067220596 = 0x64656661756c74).
Only errorCode=-7005 appears to be meaningful.
EXPECTED RESULT
Sign-in completes (2FA prompt if applicable) and the account is configured.
REPRODUCIBILITY
Deterministic - fails every time, ~2-3 seconds after clicking Sign-In.
It fails identically:
* on two completely different networks (home Wi-Fi behind a router at
192.168.99.1, and an iPhone personal hotspot at 172.20.10.1 with a
different DNS resolver and different Apple edge IPs);
* before and after Reset-AppxPackage;
* before and after a full uninstall and fresh reinstall from the Store,
with all legacy Apple desktop components removed
(Apple Application Support 8.7 32/64-bit, Bonjour 3.1.0.1,
iCloud Outlook 13.4.0.101, plus their Program Files / ProgramData
folders).
WHY THIS LOOKS LIKE A CLIENT-SIDE DEFECT, NOT A LOCAL MISCONFIGURATION
Verified working on the same machine, same attempt window:
* The Apple ID and password are correct - the same credentials sign in
successfully at appleid.apple.com in a browser.
* TCP 443 reachability and TLS certificate validation succeed for every
endpoint the app uses. These hostnames were extracted from Apple's own
binaries (iCloudHome.exe, iCloudCKFS/CFNetwork.dll):
gsa.apple.com, account.apple.com, idmsa.apple.com,
setup.icloud.com, gateway.icloud.com, www.icloud.com,
ocsp.apple.com, push.apple.com, metrics.icloud.com,
feedbackws.icloud.com, support.apple.com, www.apple.com
All: TCP 5/5, TLS verification result 0 (success).
* WinHTTP - the HTTP stack iCloudHome.exe itself uses - gets normal
responses from these endpoints (HTTP 200/401/404 as appropriate).
* No Schannel errors are logged (System event log) during the app's
sign-in attempts, i.e. the app's TLS handshakes are succeeding.
* Observation during an attempt: iCloudHome connects successfully to
gsa.apple.com's IPs and then the connections are closed by the peer
while the app retries in a loop, ending in -7005.
* No proxy and no WPAD server; Windows Firewall has an allow rule for
iCloud and no outbound block rules; hosts file clean; system clock and
timezone correct.
* Local crypto and credential stack verified functional:
KeyIso / VaultSvc / CryptSvc / TokenBroker services running; RSA and
ECDSA key generation OK; self-signed certificate creation OK; DPAPI
round-trip OK for both CurrentUser and LocalMachine; Credential Manager
reachable.
One genuine pre-existing defect was found and fixed on the machine, and did
not resolve this: the Windows trusted root store had no Apple CA, which
originally made gsa.apple.com fail TLS with SEC_E_UNTRUSTED_ROOT. Apple
Root CA and Apple Server Authentication CA were installed (verified
byte-for-byte against https://www.apple.com/appleca/AppleIncRootCertificate.cer).
-7005 persists afterwards.
Suspicion: an incompatibility between the iCloud 15.10 AuthKit path and this
Windows build (26H2 / 26300.9711). A mapping for the error code would help -
the enum 7000-7009 is present in Apple's APLZOD6432.dll but the code's
meaning is not documented.
