How to Use Dsregcmd to Check Azure AD Join Status on Windows

Start by launching Command Prompt or PowerShell with elevated privileges. Most dsregcmd operations require administrative access to read device registration information and perform join/leave operations.

Press Windows + R, type cmd, then press Ctrl + Shift + Enter to run as administrator. Alternatively, right-click the Start button and select "Windows PowerShell (Admin)" or "Command Prompt (Admin)".

Verify you have administrative privileges by running:

whoami /priv

You should see privileges like "SeDebugPrivilege" and "SeSystemtimePrivilege" listed as "Enabled" or "Disabled".

Execute the primary dsregcmd command to get a comprehensive overview of your device's registration status. This command provides detailed information about Azure AD join status, domain membership, and SSO configuration.

dsregcmd /status

The output is divided into several sections. Focus on the Device State section first, which shows three critical values:

• AzureAdJoined - Indicates if the device is registered with Microsoft Entra ID
• DomainJoined - Shows if the device is joined to an on-premises Active Directory domain
• EnterpriseJoined - Indicates workplace join status (less common)

Here's what different combinations mean:

The SSO State section provides crucial information about single sign-on capabilities and Primary Refresh Token (PRT) status. This determines whether users can seamlessly access cloud resources without repeated authentication.

In the dsregcmd output, locate the SSO State section and examine these key fields:

• AzureAdPrt - Primary Refresh Token status (should be "YES" for working SSO)
• AzureAdPrtUpdateTime - When the PRT was last refreshed
• AzureAdPrtExpiryTime - When the current PRT expires
• EnterprisePrt - Enterprise PRT status for hybrid scenarios

For detailed PRT troubleshooting, run the command as the logged-in user (not as administrator) to get user-specific token information:

dsregcmd /status

Compare the results when run as admin versus as a regular user. User context provides more accurate PRT status information.

The Tenant Details section reveals important configuration information about your Azure AD tenant and device management settings. This helps verify that the device is connecting to the correct tenant and has proper MDM enrollment.

In the dsregcmd output, review the Tenant Details section for:

• TenantName - Your organization's Azure AD tenant name
• TenantId - Unique identifier for your Azure AD tenant
• AuthCodeUrl - Authentication endpoint URL
• AccessTokenUrl - Token endpoint for API access
• MdmUrl - Mobile Device Management enrollment URL
• MdmTouUrl - MDM Terms of Use URL
• MdmComplianceUrl - Compliance policy endpoint

Cross-reference the TenantId with your Azure AD portal to ensure the device is registered to the correct tenant:

# In PowerShell, you can also check tenant info with:
Get-AzureADTenantDetail | Select-Object ObjectId, DisplayName

Look for MDM-related URLs if your organization uses Intune or another MDM solution. Missing MDM URLs might indicate enrollment issues.

The Diagnostic Data section provides detailed connectivity test results that help identify network, DNS, or configuration problems preventing proper Azure AD communication.

Examine these diagnostic tests in the output:

• AD Connectivity - Tests connection to on-premises Active Directory domain controllers
• AD Configuration - Verifies Service Connection Point (SCP) configuration for hybrid join
• DRS Discovery - Tests Device Registration Service endpoint discovery
• DRS Connectivity - Verifies connection to Azure Device Registration Service
• Token acquisition - Tests ability to obtain authentication tokens
• Fallback to Sync-Join - Indicates if device fell back to synchronous join process

Each test shows either "SUCCESS" or an error code. Common error codes include:

• 0x801c001d - DRS Discovery failure (DNS or connectivity issue)
• 0x801c0021 - Authentication failure
• 0x801c0003 - Device not found in Azure AD

For detailed error analysis, run dsregcmd in debug mode:

dsregcmd /status /debug

Use dsregcmd to perform join, leave, or refresh operations when troubleshooting device registration issues. These commands modify the device's Azure AD registration state.

For hybrid Azure AD join (most common in enterprise environments):

dsregcmd /join

This command schedules a task to register the device with Azure AD while maintaining domain membership. The process runs asynchronously, so you won't see immediate results.

To leave Azure AD (removes cloud registration but keeps domain join):

dsregcmd /leave

For troubleshooting stuck registrations, use debug mode:

dsregcmd /debug /join

To refresh the Primary Refresh Token without full re-registration:

dsregcmd /refreshprt

Complete rejoin sequence for persistent issues:

# Check current status
dsregcmd /status

# Leave Azure AD
dsregcmd /leave

# Force Group Policy update
gpupdate /force

# Restart computer
shutdown /r /t 0

After restart, log in as a domain user and run:

dsregcmd /join

When dsregcmd reveals problems, use specific troubleshooting commands and techniques to resolve common Azure AD join issues.

For devices showing "Pending" hybrid join status, check the scheduled task:

schtasks /query /tn "\Microsoft\Windows\Workplace Join\Automatic-Device-Join"

If the task exists but isn't running, trigger it manually:

schtasks /run /tn "\Microsoft\Windows\Workplace Join\Automatic-Device-Join"

For certificate-related issues, check device certificates:

certlm.msc

Navigate to Personal > Certificates and look for certificates issued by "MS-Organization-Access" or your organization's CA.

Update device attributes if there are mismatches:

dsregcmd /updatedevice

Check Windows event logs for detailed error information:

eventvwr.msc

Navigate to Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin for registration events.

For network connectivity issues, verify these URLs are accessible:

• https://enterpriseregistration.windows.net
• https://login.microsoftonline.com
• https://device.login.microsoftonline.com

Test connectivity with PowerShell:

Test-NetConnection -ComputerName enterpriseregistration.windows.net -Port 443
Test-NetConnection -ComputerName login.microsoftonline.com -Port 443