Even when you followed the Hybrid Azure AD join instructions to set up your environment (https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup ), you still might experience some issues with the computers not registering with Azure AD.
To check if the device was joined to Azure AD run “dsregcmd /status” command in command prompt and look at AzureAdJoined value. For the Azure AD registered devices, it should be set to YES.
If the AzureAdJoined says NO, next step will be to collect information from the Application and Services – Microsoft – Windows – User Device Registration – Admin logs.
First thing, try to locate and read the text description in the error to see if it gives any clue.
Below are some examples of the errors and possible solutions to try.
User Device Registration Admin log – EventID 304 or 305 – adalResponseCode: 0xcaa1000e – recommended step is to check the AD FS claim rules per mentioned above article. It is important to have the AD FS claim rules in the described order and if you have multiple verified domains, do not forget remove any existing IssuerID rule that might have been created by Azure AD Connect or other means.
User Device Registration Admin log –wmain: Unable to retrieve access token 0x80004005 – recommended step is to check the AD FS claim rules.
User Device Registration Admin log – EventID 305 – AdalErrorCode: 0xcaa90006 – make sure the computer is able to reach and authenticate to specified in the error text description Identity Provider endpoint.
User Device Registration Admin log – EventID 204 – Error code: 0x801c03f2 (“The device object by the given id (xxx) is not found.”) – make sure the on-premises computer object is synchronized to Azure AD. Run the Delta Azure AD Connect sync.
User Device Registration Admin log – EventID 304 (309, 201 and 233 coming before it) – Error code: 0x801c0021 (Error code: 0x80072efe in EventID 201) – most likely the network or proxy didn’t allow the connection to Azure AD device registration endpoints or IdP to complete authentication.
User Device Registration Admin log – 0xCAA90022 Could not discover endpoint for Integrate Windows Authentication. Check your ADFS settings. It should support Integrate Widows Authentication for WS-Trust 1.3. (error message is self explanatory). In case your IdP is not AD FS consult your IdP documentation.
Sometimes the error description of the User Device Registration Admin log event is not providing enough information and you have to enable the User Device Registration Debug log to get more information.
To enable debug logs open Event Viewer – check “Show Analytic and Debug Logs” and browse to Application and Services – Microsoft – Windows – User Device Registration – right click on Debug log and select Enable log.
To trigger the device join attempt you have to open Command prompt as System account (you can use Sysinternals PsExec – psexec -i -s cmd.exe) and issue “dsregcmd /debug /join” command. After that disable the Debug log, check the Admin logs and if still the error description is not informative go to Debug logs.
Example 1:
Log Name: Microsoft-Windows-User Device Registration/Admin
Source: Microsoft-Windows-User Device Registration
Date: 2/9/2018 10:17:49 AM
Event ID: 304
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: XXX
Description:
Automatic registration failed at join phase. Exit code: An unexpected internal error has occurred in the Platform Crypto Provider.
User Device Registration Debug log –
Log Name: Microsoft-Windows-User Device Registration/Debug
Source: Microsoft-Windows-User Device Registration
Date: 2/9/2018 10:23:30 AM
Event ID: 500
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: XXX
Description:
wmain: failed with error code 0x80290407.
Most likely this error is an indication that the TPM is not supporting Azure AD join requirements (https://docs.microsoft.com/en-us/windows/security/hardware-protection/tpm/tpm-recommendations ).
Next steps for this particular issue I would recommend for these stations are:
- Ensure the TPM is in 2.0 mode. You will find this setting in the BIOS.
- As a last resort, disable TPM in the BIOS, so Azure AD Join process uses software-based keys.
Example 2:
Log Name: Microsoft-Windows-User Device Registration/Admin
Source: Microsoft-Windows-User Device Registration
Date: 4/17/2018 12:44:10 PM
Event ID: 304
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: XXX
Description:
Automatic registration failed at join phase. Exit code: Keyset does not exist. Server error: empty.
After running dsregcmd /debug /join see following in the output:
DsrDeviceAutoJoinFederated failed with -2146893802
wmain: failed with error code 0x80090016.
Most likely this error indicates that the machine was imaged from the already Azure AD registered computer. Also it might indicate the TPM issues (see the TMP troubleshooting steps mentioned above).
If the fist is true, try renaming the “C:\ProgramData\Microsoft\Crypto\Keys” folder and re-running the dsregcmd /debug /join.
Example 3:
Log Name: Microsoft-Windows-User Device Registration/Admin
Source: Microsoft-Windows-User Device Registration
Date: 5/16/2018 8:44:03 AM
Event ID: 305
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: XXX
Description:
Automatic registration failed at authentication phase. Unable to acquire access token. Exit code: Unspecified error. Server error: AdalMessage: ADALUseWindowsAuthenticationTenant failed, unable to preform integrated auth
AdalErrorCode: 0xcaa9002c
This error usually indicates an issue with connecting to AD FS farm. Check if Windows Integrated Authentication is enabled for Intranet, is working correctly for Intranet and WSTrust windows endpoints are enabled in AD FS.
