Windows 10 Windows Hello For Business dont work 3td MFA

[Vladislav GennFom]

Hi! Help me please!
I used instruction for set up WHFB( on-premis on the key trust).
I set up and every step of the guide and checked 10 times over.
I use third-party MFA, I registrated MFA in ADFS and check. My MFA work.

The client log Microsoft-Windows-HelloForBusiness/Operational errors out with:
1. The Primary Account Primary Refresh Token prerequisite check failed (Event ID 7201).
2. The device registration prerequisite check failed(Event ID 7200).
3. Windows Hello for Business prerequisites check failed. Error: 0x0(Event ID 7054).
and repeat...

Result comands DSREGCMD /DEBUG and DSREGCMD /STATUS:

dsregcmd::wmain logging initialized.
PreJoinChecks Complete.
preCheckResult: DoNotJoin
isPrivateKeyFound: undefined
isJoined: undefined
isDcAvailable: undefined
isSystem: NO
keyProvider: undefined
keyContainer: undefined
dsrInstance: undefined
elapsedSeconds: 0
resultCode: 0x1
The device can NOT be joined. The process MUST run as NT AUTHORITY\SYSTEM.

+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+

AzureAdJoined : NO
EnterpriseJoined : NO
DomainJoined : YES
DomainName : WINHELLO

+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+

NgcSet : NO
WorkplaceJoined : NO
WamDefaultSet : NO

+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+

AzureAdPrt : NO
AzureAdPrtAuthority : NO
EnterprisePrt : NO
EnterprisePrtAuthority : NO

+----------------------------------------------------------------------+
| Diagnostic Data |
+----------------------------------------------------------------------+

Diagnostics Reference : www.microsoft.com/aadjerrors
User Context : UN-ELEVATED User
Client Time : 2019-07-10 11:49:29.000 UTC
AD Connectivity Test : PASS
AD Configuration Test : PASS
DRS Discovery Test : PASS
DRS Connectivity Test : PASS
Token acquisition Test : FAIL [0xcaa9002c/0xcaa1000e] Correlation-id: {EE96163B-8710-42E0-8AC6-1F358EB5D6CD}
Fallback to Sync-Join : ENABLED

Previous Registration : 2019-07-10 11:16:58.000 UTC
Registration Type : fed
Error Phase : auth
Client ErrorCode : 0xcaa1000e
Correlation Id : {65934446-ABB9-468C-991E-DC6E78BFB692}

+----------------------------------------------------------------------+
| Ngc Prerequisite Check |
+----------------------------------------------------------------------+

IsDeviceJoined : NO
IsUserAzureAD : NO
PolicyEnabled : YES
PostLogonEnabled : YES
DeviceEligible : YES
SessionIsNotRemote : YES
CertEnrollment : none
PreReqResult : WillNotProvision

More...