Fix Microsoft Entra hybrid join failures with dsregcmd /status

To troubleshoot a Windows device that won't Microsoft Entra hybrid join, run dsregcmd /status from an elevated command prompt and read three things: DomainJoined and AzureAdJoined in Device State, then Error Phase and Client ErrorCode in Diagnostic Data. The error phase (pre-check, discover, auth or join) tells you where registration stopped, and the client error code maps to a specific cause such as an unreadable service connection point, a proxy blocking the SYSTEM account, a federation server problem, or a computer object that Microsoft Entra Connect hasn't synced yet.

Who this is for and what you will have at the end

This guide is for administrators running hybrid identity with Microsoft Entra Connect whose domain-joined Windows devices don't hybrid join, sit in Pending, or join but give users no single sign-on.

At the end you will be able to:

• Run dsregcmd /status in the right context and know which sections to trust.
• Map an error phase and client error code to its cause and fix.
• Check the service connection point (SCP) and network path the device uses.
• Confirm the result in the Microsoft Entra admin center and with Microsoft Graph PowerShell.
• Recover devices stuck in Pending and re-register a device cleanly.

Hybrid join usually exists to support device-based Conditional Access; the policy side is covered in requiring compliant devices with Conditional Access.

How hybrid join works

1. The device reads the SCP object from the configuration naming context of its Active Directory forest. The SCP holds two keywords, azureADId:<TenantID> and azureADName:<verified domain>. The verified domain decides whether the device follows the managed or federated registration flow.
2. Registration runs in the SYSTEM context, triggered by a scheduled task. The task is under Task Scheduler Library > Microsoft > Windows > Workplace Join > Automatic-Device-Join.
3. In managed domains (password hash sync or pass-through authentication), the device performs a sync join. The computer object must first be synced to Microsoft Entra ID by Microsoft Entra Connect, so a first attempt before sync fails by design.
4. In federated domains, the device gets a token from the federation service through integrated Windows authentication to a WS-Trust endpoint. From Windows 10 1803, if that fails, Windows falls back to sync join unless the fallback is disabled.

dsregcmd /status reports the outcome of these steps. The combination of three values in Device State gives the join type:

Prerequisites

Confirm the environment first. Many "device" problems are configuration problems that affect every machine in an OU or site.

• Microsoft Entra Connect version 1.1.819.0 or later, with Configure device options > Configure Microsoft Entra hybrid join completed for each forest.
• Sync scope: the OUs that contain the computer objects are selected in Microsoft Entra Connect, and the default device attributes are not excluded from sync.
• Device setting: users are allowed to register their devices with Microsoft Entra ID.
• Network access from the SYSTEM context to:
  • https://enterpriseregistration.windows.net
  • https://login.microsoftonline.com
  • https://device.login.microsoftonline.com
  • https://autologon.microsoftazuread-sso.com (if you use seamless SSO)
  • Your federation service (federated domains only)
• Proxy: if you need an outbound proxy, the computer account must be able to discover it (WPAD, or WinHTTP proxy settings from Windows 10 1709) and authenticate to it silently, because registration runs in machine context.
• TLS inspection: exclude https://device.login.microsoftonline.com and https://enterpriseregistration.windows.net from break-and-inspect. Inspection interferes with client certificate authentication, device registration and device-based Conditional Access.
• Federated domains: the AD FS WS-Trust endpoints /adfs/services/trust/2005/windowstransport and /adfs/services/trust/13/windowstransport (plus the usernamemixed and certificatemixed variants) enabled. The windowstransport endpoints must be intranet-facing only.
• Admin roles: Hybrid Identity Administrator to configure Microsoft Entra Connect, Enterprise Administrator credentials for each forest so the wizard can create the SCP, and at least Cloud Device Administrator to view device state in the admin center.

Step 1: Run dsregcmd /status in the right context

The same command returns different information depending on who runs it.

# Elevated prompt: join diagnostics run as SYSTEM, KeySignTest can run
dsregcmd /status
 
# Normal prompt as the signed-in user: valid User State and SSO State (PRT)
dsregcmd /status

The User Context line in Diagnostic Data shows SYSTEM, UN-ELEVATED User or ELEVATED User, so you can always tell which run you're looking at.

Step 2: Check the device state

Compare these fields with the expected values:

If AzureAdJoined is YES, skip to Step 5. If it's NO, read Diagnostic Data.

Step 3: Read the diagnostic tests and error phase

On Windows 10 1803 and later, the pre-join diagnostics look like this:

+----------------------------------------------------------------------+
| Diagnostic Data                                                      |
+----------------------------------------------------------------------+
     Diagnostics Reference : www.microsoft.com/aadjerrors
              User Context : SYSTEM
      AD Connectivity Test : PASS
     AD Configuration Test : PASS
        DRS Discovery Test : FAIL [0x801c0021/0x80072ee2]
     DRS Connectivity Test : SKIPPED
    Token acquisition Test : SKIPPED
     Fallback to Sync-Join : ENABLED
 
     Previous Registration : 2019-01-31 09:23:30.000 UTC
               Error Phase : discover
          Client ErrorCode : 0x801c0021
+----------------------------------------------------------------------+

Each test lines up with a phase:

• AD Connectivity Test checks the domain controller. Failures show up in the pre-check phase.
• AD Configuration Test reads and validates the SCP. Failures usually produce 0x801c001d in the discover phase.
• DRS Discovery Test fetches the registration endpoints and performs a user realm request. Failures appear in the discover phase. The value in brackets is the error and sub-error, here a generic discovery failure caused by a network timeout.
• DRS Connectivity Test is a basic connectivity test to the registration service.
• Token Acquisition Test gets a token from the federation service for federated tenants. Failures appear in the auth phase.

Below the tests, Error Phase, Client ErrorCode, Server ErrorCode, Server Message and Request Id describe the last failed attempt. Only failed attempts are logged. On Windows 10 versions earlier than 1803, find the same information in Event Viewer under Applications and Services Log > Microsoft > Windows > User Device Registration, events 304, 305 and 307.

Step 4: Fix the failure by phase

Pre-check phase

The device has no line of sight to a domain controller. It must be on the internal network, or on a VPN with network line of sight to an on-premises domain controller, when registration runs.

Discover phase

The device either can't read a valid SCP or can't reach the registration and realm discovery endpoints as SYSTEM. Check the SCP first. For a forest named fabrikam.com:

$scp = New-Object System.DirectoryServices.DirectoryEntry
$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=fabrikam,DC=com"
$scp.Keywords

The output should list azureADName: with a verified domain and azureADId: with your tenant ID. In a multi-forest environment the SCP must exist in every forest that contains domain-joined computers.

Auth phase (federated domains only)

The device couldn't get a token silently for the registration service from your federation service. Check the WS-Trust endpoints and the Metadata Exchange (MEX) response. Event ID 305 in the User Device Registration log carries the error and server error codes.

Join phase

The registration request reached the service but was rejected, or the TPM failed. The Registration Type line shows whether it was a sync or federated join.

The most common server messages for a sync join are:

• "The device object by the given id isn't found." Expected until Microsoft Entra Connect syncs the computer object. Wait for a sync cycle; the next attempt succeeds. If it never does, check that the OU is in sync scope.
• "AADSTS90002: Tenant UUID not found." The tenant ID in the SCP is wrong.
• AuthenticationError mentioning verification of the target computer's SID. Usually sync hasn't finished yet.
• "Your request is throttled temporarily. Please try after 300 seconds." Several requests in quick succession; wait and retry.

Step 5: Check post-join health and the PRT

A device can be joined and still give users no single sign-on. In the elevated output, check:

• DeviceAuthStatus in Device Details: SUCCESS means the device is present and enabled in Microsoft Entra ID. FAILED. Device is either disabled or deleted means exactly that.
• KeySignTest: PASSED means the device keys are healthy. A failure usually marks the device for recovery, which is silent for hybrid joined devices at the next sign-in.
• AadRecoveryEnabled: YES means the stored keys aren't usable and the next sign-in triggers recovery.

Then, as the signed-in user, check SSO State. AzureAdPrt : NO means the Primary Refresh Token couldn't be acquired. If AzureAdPrtUpdateTime is more than four hours old, lock and unlock the device and check whether it updates. From Windows 10 21H1 the output includes Attempt Status, Server Error Code and Server Error Description for the last failed attempt.

Remember that a hybrid joined device disabled in Microsoft Entra ID is re-enabled at the next sync cycle if the computer account is enabled on-premises. Disable it in Active Directory instead.

Verify the join in Microsoft Entra ID

In the Microsoft Entra admin center, browse to Entra ID > Devices > All devices and search for the device. If the Registered column shows Pending, hybrid join hasn't completed. A date and time means it has.

With Microsoft Graph PowerShell, look the device up by the DeviceId from dsregcmd /status:

Connect-MgGraph -Scopes "Device.Read.All"
 
$id = "00aa00aa-bb11-cc22-dd33-44ee44ee44ee"   # DeviceId from dsregcmd /status
Get-MgDevice -Filter "deviceId eq '$id'" |
    Select-Object DisplayName, DeviceId, TrustType, AccountEnabled, ApproximateLastSignInDateTime

TrustType should be ServerAd (on-premises domain joined devices joined to Microsoft Entra ID) and AccountEnabled should be True. Note that -DeviceId on Get-MgDevice takes the object ID, not the device ID, which is why the example uses a filter.

Recover devices stuck in Pending

Pending devices exist only for hybrid join. Microsoft Entra Connect creates the device object and sets it to Pending until the device registers. Two scenarios leave it stuck:

1. The device never completes registration, usually because of the network or SCP problems in Step 4.
2. The object left sync scope and came back. Moving a computer to an OU that isn't synced makes Microsoft Entra Connect delete the device in Microsoft Entra ID. Moving it back creates a new Pending object, and the device, which considers itself already registered, never completes registration.

For the second case, unregister and let the scheduled task re-register:

# Elevated prompt on the affected device
dsregcmd.exe /debug /leave
# Then restart, or sign out and sign in, to trigger Automatic-Device-Join

To count Pending devices across the tenant:

(Get-MgDevice -All -Filter "TrustType eq 'ServerAd'" |
    Where-Object { -not $_.AlternativeSecurityIds }).Count

Collect logs when the cause isn't clear

• User Device Registration event log: 304, 305 and 307 for join failures, 201 for discovery sub-errors, 204 for join phase errors.
• AAD operational and analytic logs (Applications and Services Log > Microsoft > Windows > AAD): events 1006 and 1007 bracket PRT acquisition, and 1007 logs the final error code.

Checklist

• Microsoft Entra Connect device options configured; computer OUs in sync scope; default device attributes synced.
• SCP present in every forest with the right azureADId and a verified azureADName.
• Registration and login endpoints reachable as SYSTEM, through a proxy the computer account can authenticate to, without TLS inspection.
• For federated domains, WS-Trust endpoints enabled and published in MEX; windowstransport intranet-only.
• dsregcmd /status shows DomainJoined : YES and AzureAdJoined : YES, DeviceAuthStatus : SUCCESS, and AzureAdPrt : YES for the signed-in user.
• Device shows a registration date in All devices, not Pending, with TrustType ServerAd.
• Pending devices recovered with dsregcmd /debug /leave and a restart.

References

• Troubleshoot devices by using the dsregcmd command
• Troubleshoot Microsoft Entra hybrid joined devices
• Configure Microsoft Entra hybrid join
• Manual configuration for Microsoft Entra hybrid join
• Verify Microsoft Entra hybrid join state
• Pending devices in Microsoft Entra ID
• Microsoft Entra device management FAQ
• Get-MgDevice
• device resource type