How to fix error 0x801c001d (Microsoft Entra hybrid join)

Applies to: domain-joined Windows 11 and Windows 10 PCs set up for Microsoft Entra hybrid join. It usually shows up in dsregcmd /status or as Event ID 304 or 307 in the User Device Registration log, and can block Windows Hello for Business, Intune enrollment and single sign-on to Microsoft 365.

What error 0x801c001d means

Before a domain-joined PC can hybrid join, it looks up a special object in the configuration partition of your Active Directory forest, the service connection point. The SCP holds your Entra tenant’s name and ID. Error 0x801c001d means that lookup failed. The usual reasons are:

• No domain controller in reach: the PC is off the company network, on a VPN that isn’t connected yet, or DNS points it at the wrong servers.
• No SCP, or the wrong one: hybrid join was never configured in Microsoft Entra Connect for this forest, or the SCP names an old tenant.
• Permissions: the computer account can’t read the SCP object, which can happen after someone tightens permissions on the configuration partition.

Confirm the error on the PC

Open Command Prompt (it doesn’t need to be elevated) and run:

dsregcmd /status

In the output, DomainJoined : YES and AzureAdJoined : NO together mean hybrid join hasn’t finished. Look in the Diagnostic Data section for Client ErrorCode : 0x801c001d. Then open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin. Events 304 and 307 show the failed join, and nearby events often name the step that failed.

Fix 1: Make sure the PC can reach a domain controller

Plug the PC into the office network, or connect the company VPN before signing in if it supports that. Then check that Windows can find a domain controller, replacing the domain name with your own:

nltest /dsgetdc:contoso.com

If this fails, fix name resolution first: the network adapter should use your internal DNS servers, not a public resolver. Run ipconfig /flushdns after changing DNS. To manage the Group Policy settings involved, see how to install the Group Policy Management Console.

Fix 2: Check the service connection point (SCP)

On a domain-joined PC, run this in PowerShell, changing the DC= parts to match your forest root domain:

$scp = New-Object System.DirectoryServices.DirectoryEntry
$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=contoso,DC=com"
$scp.Keywords

It should return two values, azureADName (your tenant domain) and azureADId (your tenant ID). If it returns nothing or an error, the SCP is missing or unreadable. An admin can create or correct it by opening Microsoft Entra Connect, choosing Configure device options and then Configure Microsoft Entra hybrid join, and selecting the forest. Check the tenant values against Microsoft Entra admin center > Overview.

Some organizations use a client-side SCP instead, set by Group Policy in the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD (values TenantId and TenantName), usually for a controlled rollout. If yours does, check those values on the affected PC.

Fix 3: Check that the computer is synced to Entra ID

For a managed (non-federated) domain, the computer object has to be synced to Entra ID by Microsoft Entra Connect before the join can complete. Make sure the OU that holds the computer is included in Entra Connect’s sync scope, then look for the device in Microsoft Entra admin center > Devices > All devices. A freshly synced device can take one or two sync cycles to appear. If the device was deleted from Entra ID, it may also need to rejoin; see Your organization has deleted this device.

Fix 4: Retry the join

Once the PC can read the SCP, trigger the join again. Restart the PC and sign in, or open Task Scheduler, go to Task Scheduler Library > Microsoft > Windows > Workplace Join and run the Automatic-Device-Join task. Run dsregcmd /status again; AzureAdJoined should change to YES.

If the PC still shows an old, broken registration, an admin can run dsregcmd /leave in an elevated Command Prompt and restart to start clean. Only do this on a domain-joined PC that is meant to hybrid join, because it removes the current Entra registration. Problems enrolling in Intune afterwards are covered in Device management could not be enabled.

Related guides

• Device management could not be enabled: how to fix it
• Your organization has deleted this device: how to fix it
• A required authentication broker is missing: how to fix it
• How to install the Group Policy Management Console on Windows 11

Official sources:

• Microsoft Learn: Troubleshoot Microsoft Entra hybrid joined devices
• Microsoft Learn: Configure Microsoft Entra hybrid join

Frequently asked questions

Can a home user fix 0x801c001d?

Usually not. The error comes from a company’s Active Directory and Entra setup. If you see it on a work laptop, connect to the office network or VPN and restart; if it stays, send your IT team the dsregcmd /status output.

Does the error stop me from working?

The PC still signs in to the domain, but features that rely on Entra, such as Windows Hello for Business, Intune management, Conditional Access and seamless Microsoft 365 sign-in, may not work until the join succeeds.

Why does it happen only away from the office?

The PC needs a domain controller to read the SCP. At home without the VPN it can’t reach one, so the join attempt fails until the next time it’s on the company network.