When a Windows device won't finish Microsoft Entra hybrid join, or joins but never gets a Primary Refresh Token (PRT), Windows records the reason in three places: the Diagnostic Data block of dsregcmd /status, the User Device Registration Admin log and the AAD logs. This quick reference lists the codes Microsoft documents for them, grouped by the phase where things stopped, with the meaning, the usual cause and the first check.
Codes in this quick reference
AD Connectivity Test : FAIL: no line of sight to a domain controller (pre-check)dsregcmd /status (Diagnostic Data)AD Configuration Test : FAIL: the service connection point can't be read or is wrongdsregcmd /status (Diagnostic Data)DRS Discovery Test : FAIL [code/sub-code]: discovery or user realm request faileddsregcmd /status (Diagnostic Data)DRS Connectivity Test : FAIL: no connection to the device registration servicedsregcmd /status (Diagnostic Data)Token acquisition Test : FAIL: no Entra token for a federated joindsregcmd /status (Diagnostic Data)DeviceAuthStatus : ERROR: the device health check couldn't rundsregcmd /status (Device Details)AadRecoveryEnabled : YES: device keys unusable, device marked for recoverydsregcmd /status (Diagnostic Data)KeySignTest: : MUST Run elevated to test.dsregcmd /status (Device State)
+ 45 more codes in the tables below.
How to read these codes#
- Run
dsregcmd /statusfrom an elevated prompt. The pre-join tests then run as SYSTEM, the same context as the real join. Run it again un-elevated as the user for User State and SSO State (the WAM fields can show an error when elevated). - Error Phase (
pre-check,discover,authorjoin) tells you which table to use. Client ErrorCode is the HRESULT; Server ErrorCode and Server Message appear only when the device registration service (DRS) answered. - A failed test can show two codes, such as
DRS Discovery Test : FAIL [0x801c0021/0x80072ee2]: the second one is the sub-error that names the real cause. - Builds older than Windows 10 version 1803 have no Diagnostic Data block. Use Applications and Services Logs › Microsoft › Windows › User Device Registration › Admin instead.
- After the join, PRT failures appear as Attempt Status under SSO State (Windows 10 version 21H1 and later) or in Microsoft › Windows › AAD: errors in Operational, informational events in Analytic (enable it with View › Show Analytic and Debug Logs).
PowerShell
dsregcmd /status
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 201, 204, 220, 304, 305, 307 } -MaxEvents 20 |
Format-List TimeCreated, Id, Message
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Operational'; Id = 1081, 1084, 1088 } -MaxEvents 20 |
Format-List TimeCreated, Id, MessageCodes already explained in a full guide on this site link to it instead of repeating it. For the policy side of setup, see configuring hybrid join with an SCP.
dsregcmd fields that point at the problem#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AD Connectivity Test : FAIL | No connection to a domain controller | Device off the internal network or VPN | Restore line of sight to a DC; the join stops at pre-check until then |
AD Configuration Test : FAIL | Service connection point (SCP) unreadable or invalid | SCP missing or misconfigured in the forest | Check the SCP; expect 0x801c001d in the discover phase |
DRS Discovery Test : FAIL | Discovery metadata or user realm request failed | Proxy, firewall or DNS | Look up the sub-error in the next table |
DRS Connectivity Test : FAIL | Basic connection to DRS failed | enterpriseregistration.windows.net blocked for SYSTEM | Let the computer account through the proxy |
Token acquisition Test : FAIL | Federated tenants only: no Entra token for the join | Federation service or WS-Trust problem | Authentication-phase table; sync join is tried next |
Fallback to Sync-Join not ENABLED | No sync-join fallback after an authentication failure | FallbackToSyncJoin = 0 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ | Remove the value (fallback is on by default) or fix federation |
DeviceAuthStatus : ERROR | The device health check couldn't run | No connectivity to Entra ID as SYSTEM | Fix connectivity and rerun elevated |
DeviceAuthStatus : FAILED. Device is either disabled or deleted | Device object disabled or deleted in Entra ID | Cleanup or stale-device policy | Guide |
AadRecoveryEnabled : YES | Device keys unusable; device marked for recovery | Key or TPM problem | The next sign-in re-registers it: silently for hybrid joined devices, with a prompt otherwise |
KeySignTest: : MUST Run elevated to test. | Key health test skipped | dsregcmd ran un-elevated | Rerun elevated; PASSED means healthy keys |
Virtual Desktop : INVALID | VDI metadata present but set incorrectly | VDI provisioning metadata | Compare the metadata dsregcmd prints with the vendor's settings |
DomainJoined : YES but AzureAdJoined : NO | Join not finished | Any phase below | Guide |
WorkplaceJoined : YES on a hybrid joined PC | Work account added before the join completed | Dual state | Guide |
Discover phase#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801c001d DSREG_AUTOJOIN_ADCONFIG_READ_FAILED | SCP couldn't be read; no tenant information | Missing or wrong SCP | Guide |
0x801c0021 DSREG_AUTOJOIN_DISC_FAILED | Generic discovery failure | See the sub-error | Guide |
0x801c001f DSREG_AUTOJOIN_DISC_WAIT_TIMEOUT | Discovery timed out | enterpriseregistration.windows.net unreachable as SYSTEM | Test the endpoint in SYSTEM context |
0x801c003d DSREG_AUTOJOIN_USERREALM_DISCOVERY_FAILED | Realm discovery failed: managed or federated unknown | login.microsoftonline.com unreachable as SYSTEM (version 1809 and later) | Read the sub-error; allow SYSTEM through the proxy |
0x801c003a DSREG_DISCOVERY_TENANT_NOT_FOUND | Tenant not found | Wrong tenant ID in the SCP, or no active subscription | Correct the SCP's tenant ID |
0x801c0025 DSREG_SERVER_BUSY | HTTP 503 from DRS | Service temporarily unavailable | Nothing to fix; a later attempt usually works |
0x8007000d E_INVALIDDATA | Response JSON couldn't be parsed | Proxy returned HTTP 200 with an HTML sign-in page | Let SYSTEM authenticate silently to the proxy |
0x80072efd WININET_E_CANNOT_CONNECT | Connection couldn't be established | Firewall or proxy | Check the hybrid join network requirements |
0x80072ee2 WININET_E_TIMEOUT | Network timeout | Firewall or proxy | Guide |
0x80072f8f WININET_E_DECODING_FAILED | Response couldn't be decoded | Proxy modifying the response | Exclude Microsoft endpoints from inspection |
Authentication phase (federated domains)#
Only federated domains reach this phase: Windows asks the federation service for a token with integrated Windows authentication against an active WS-Trust endpoint. Event 305 holds the code, sub-error and server error.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0xcaa90017 ERROR_ADAL_PROTOCOL_NOT_SUPPORTED | Protocol isn't WS-Trust | Identity provider without WS-Trust | The on-premises provider must support WS-Trust |
0xcaa9002c ERROR_ADAL_FAILED_TO_PARSE_XML | No XML from the federation service | Broken MEX endpoint or a proxy answering | Confirm MEX returns valid XML |
0xcaa90023 ERROR_ADAL_COULDNOT_DISCOVER_USERNAME_PASSWORD_ENDPOINT | No username/password endpoint found | WS-Trust endpoints disabled or absent from MEX | Enable them; recheck the MEX response |
0xcaa82ee2 ERROR_ADAL_INTERNET_TIMEOUT | Network timeout | Entra ID or the provider unreachable as SYSTEM | Test both endpoints as SYSTEM |
0xcaa82efe ERROR_ADAL_INTERNET_CONNECTION_ABORTED | Connection to the authorization endpoint aborted | Unstable network | Retry later or from another network |
0xcaa82f8f ERROR_ADAL_INTERNET_SECURE_FAILURE | Server TLS certificate couldn't be validated | Clock skew or interception | Check the client's time, then retry |
0xcaa82efd ERROR_ADAL_INTERNET_CANNOT_CONNECT | Couldn't connect to login.microsoftonline.com | Firewall or proxy | Check that connection |
0xcaa20003 ERROR_ADAL_SERVER_ERROR_INVALID_GRANT | Entra ID didn't accept the on-premises SAML token | Federation server settings | Find the server error in the authentication logs |
0xcaa90014 ERROR_ADAL_WSTRUST_REQUEST_SECURITYTOKEN_FAILED | WS-Trust fault; no assertion | Federation server settings | Read the server error code |
0xcaa90006 ERROR_ADAL_WSTRUST_TOKEN_REQUEST_FAIL | Token endpoint returned an error | Varies | Find the underlying error in the ADAL log |
0xcaa1002d ERROR_ADAL_OPERATION_PENDING | General ADAL failure | Varies | Read the sub-error or server error |
Join phase#
The request reached DRS. Windows 10 version 1803 and later show Registration Type (sync for a sync join) with the server's answer; older builds log event 204.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801c03f2 DSREG_E_DIRECTORY_FAILURE | DRS answered DirectoryError | See the server message | Guide |
0x801c0002 DSREG_E_DEVICE_AUTHENTICATION_ERROR | DRS answered AuthenticationError (sub-code not DeviceNotFound) | See the server message | Use the server rows below |
0x801c0006 DSREG_E_DEVICE_INTERNALSERVICE_ERROR | Error response from DRS | See the server message | Use the server rows below |
DirectoryError: Your request is throttled temporarily. Please try after 300 seconds. | Federated join throttled | Several registration requests in quick succession | Wait out the cool-down, then retry |
DirectoryError: AADSTS90002: Tenant UUID not found. | Sync join can't find the tenant | Wrong tenant ID in the SCP, or no active subscription | Fix the SCP; check subscriptions |
DirectoryError: The device object by the given ID isn't found. | Sync join before the computer synced | Expected until Entra Connect exports the computer | Wait for sync. Guide |
AuthenticationError: The verification of the target computer's SID | Device certificate doesn't match the one that signed the sync-join blob | Sync not finished | Wait for Entra Connect Sync; the next attempt works |
0x80090016 NTE_BAD_KEYSET | TPM keyset doesn't exist | Cleared TPM or bad sysprep image | Guide |
0x80290407 TPM_E_PCP_INTERNAL_ERROR | Generic TPM error | TPM fault | Version 1809 and later join without the TPM; otherwise disable it |
0x80280036 TPM_E_NOTFIPS | TPM in FIPS mode not supported | FIPS mode | As above |
0x80090031 NTE_AUTHENTICATION_IGNORED | TPM locked out | Transient lockout | Wait for the cool-down; the join succeeds later |
0x80072ee7 WININET_E_NAME_NOT_RESOLVED | Server name not resolved | DNS or proxy | Check enterpriseregistration.windows.net |
0x80072efe WININET_E_CONNECTION_ABORTED | Connection ended abnormally | Unstable network | Retry from a stable network |
Event ID 220 (with 0x801c001d) | Windows can't access the computer object in Active Directory | Replication: codes 1312 (ERROR_NO_SUCH_LOGON_SESSION) or 1317 (ERROR_NO_SUCH_USER) | Often transient; check replication |
After the join: PRT and CloudAP codes#
Joined but no SSO? Run dsregcmd /status as the user: AzureAdPrt : NO plus an Attempt Status. The PRT guide explains the flow.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0xc000006d STATUS_LOGON_FAILURE | HTTP 400 from Entra ID or WS-Trust | Credentials or proxy | Guide |
0xc000006a STATUS_WRONG_PASSWORD | HTTP 400 from Entra ID or WS-Trust | Credentials, or proxy blocking the computer account | Events 1081 and 1088 hold the server error |
0xc00000d0 STATUS_REQUEST_NOT_ACCEPTED | HTTP 400 from Entra ID or WS-Trust | Server-side rejection | Events 1081 and 1088; event 1022 has the URL |
0xc000023c / 0xc00000be / 0xc00000c4 | Network unreachable, bad network path, unexpected network error | Endpoint blocked, or an HTTP error above 400 | Event 1084 has the network sub-error |
0xc000005f STATUS_NO_SUCH_LOGON_SESSION | Realm discovery couldn't find the user's domain | UPN suffix isn't a verified domain | Guide |
0xc004844c AAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED | UPN not in the expected format | Non-routable UPN such as contoso.local | Event 1144 shows the UPN sent; whoami /upn should return the internet-style UPN |
0xc0048442 AAD_CLOUDAP_E_OAUTH_USER_SID_IS_EMPTY | User SID missing from the ID token | Proxy changing the response | Bypass the proxy for Entra endpoints |
0xc00484c1 AAD_CLOUDAP_E_WSTRUST_SAML_TOKENS_ARE_EMPTY | Error from the WS-Trust endpoint | Federation server or proxy | Event 1088 has the details |
0xc004848b AAD_CLOUDAP_E_HTTP_PASSWORD_URI_IS_EMPTY | MEX response lists no password URLs | MEX misconfigured or altered | Fix the MEX configuration |
0xc004848c AAD_CLOUDAP_E_HTTP_CERTIFICATE_URI_IS_EMPTY | MEX response lists no certificate URLs | MEX misconfigured | Fix the identity provider's MEX |
0xc00cee4f WC_E_DTDPROHIBITED | WS-Trust XML included a DTD | Identity provider configuration | Stop the provider sending a DTD |
AADSTS50155 / AADSTS50034 / AADSTS50126 | Server errors behind a failed PRT | Deleted device, unknown user, wrong or unsynced password | Guide |
WinHTTP 12002 / 12007 / 12029 / 12030 | Timeout, name not resolved, can't connect, connection error | Network or proxy | Guide |
Device-related AADSTS codes in the 135000 range are in part 5 of the AADSTS list; MDM enrollment codes (0x8018xxxx) are in the Intune enrollment reference.
Event IDs to search for#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| Event ID 304 / 305 / 307 | Join failure with phase and code | Any phase above | Guide |
| Event ID 201 | Discovery sub-error (before version 1803) | Network or proxy | Discover-phase table |
| Event ID 204 | Join-phase error (before version 1803) | DRS, TPM or network | Join-phase table |
| Event ID 1006 / 1007 (AAD Analytic) | Start and end of PRT acquisition; 1007 has the final error | Any PRT failure | Read everything logged between them |
| Event ID 1022 (AAD Analytic) | URL being accessed | Points at the failing endpoint | Check the proxy path to that URL |
| Event ID 1081 / 1088 (AAD Operational) | Server error from Entra ID / WS-Trust | Server-side rejection | Guide |
| Event ID 1084 (AAD Operational) | Network sub-error | Connectivity | Pair it with event 1022 |
| Event ID 1144 (AAD Analytic) | UPN that was sent | Wrong or non-routable UPN | Compare with the user's Entra UPN |
How to verify a fix#
- Rerun
dsregcmd /statuselevated:AzureAdJoined : YES,DeviceAuthStatus : SUCCESS, and no pre-join Diagnostic Data block (it only appears while the join is failing). - As the user,
AzureAdPrt : YESwith a recentAzureAdPrtUpdateTime. If the time is more than four hours old, lock and unlock the device and check again. - In the Microsoft Entra admin center, the device shows the hybrid joined join type with a registered date instead of Pending.
- No new errors in the User Device Registration Admin and AAD Operational logs after the next sign-in.
