Quick answer: Automatic registration failed at join phase is logged by Windows in the User Device Registration event log (usually event ID 304) when a domain-joined PC fails to register itself with Microsoft Entra ID (formerly Azure AD). If your organization doesn’t use hybrid join, the event is harmless and you can turn off the attempts with Group Policy. If it does, run dsregcmd /status, read the Client ErrorCode and fix the cause, which is most often an unreachable registration endpoint, a missing service connection point or a device that hasn’t synced yet.
Applies to: domain-joined Windows 11 and Windows 10 PCs.
In this guide
What the error means
Every domain-joined Windows PC runs a scheduled task, Automatic-Device-Join (in Task Scheduler under Microsoft > Windows > Workplace Join), at sign-in and startup. It tries to register the computer as a hybrid Microsoft Entra joined device. Registration happens in steps: Windows first discovers your tenant, then joins (registers the device), then authenticates. When the join step fails, you get this event.
To see the details, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin. Microsoft’s troubleshooting guide points to events 304, 305 and 307 here. The event text includes an error code such as 0x801c001d or 0x80072ee2, which tells you what went wrong. Our Event Viewer guide shows how to filter a log by event ID.
First: do you use hybrid join at all?
Ask your Microsoft 365 or Entra administrator, or check yourself: hybrid join needs a service connection point (SCP) in Active Directory that points to your Entra tenant, and computer accounts synced to the cloud with Microsoft Entra Connect. If your company only has on-premises Active Directory and no Microsoft 365 or Entra ID, Windows still tries to register and logs this error every time. It doesn’t affect sign-in, file shares or anything else.
If you don’t: stop the registration attempts
Use Group Policy so the setting applies to every PC (our Group Policy Management Console guide covers editing a domain policy):
- Edit a GPO linked to the computers, or open
gpedit.mscon a single PC. - Go to Computer Configuration > Administrative Templates > Windows Components > Device Registration.
- Set Register domain joined computers as devices to Disabled.
- Run
gpupdate /forceor wait for the next policy refresh.
Don’t do this if your organization plans to use Intune, Windows Hello for Business or conditional access with hybrid join: those depend on registration working.
If you do: read dsregcmd /status
On the affected PC, open Command Prompt as administrator and run:
dsregcmd /statusUnder Device State, a healthy hybrid joined PC shows AzureAdJoined : YES and DomainJoined : YES. If AzureAdJoined is NO, scroll to the Diagnostic Data section and look under Previous Registration for:
- Error Phase: should say join for this event.
- Client ErrorCode: the main error code, matched in the table below.
- Server ErrorCode and Server Message: filled in when the registration service rejected the request.
Common error codes and fixes
| Error code | What it means | Fix |
|---|---|---|
| 0x801c001d (DSREG_AUTOJOIN_ADCONFIG_READ_FAILED) | Windows couldn’t read the computer object or registration settings from Active Directory. | Check that the SCP exists. If event 220 is also logged, troubleshoot AD replication between domain controllers. |
| 0x80072ee2, 0x80072ee7, 0x80072efe | Timeout, name not resolved or connection aborted while contacting Microsoft. | Make sure the PC can reach https://enterpriseregistration.windows.net and https://login.microsoftonline.com in the system context, including through any proxy or firewall. |
| 0x801c0021 (DSREG_AUTOJOIN_DISC_FAILED) | Tenant discovery failed, often with a network sub-error. | Same network checks as above. Also confirm the SCP points to a verified domain in your tenant. |
| 0x801c03f2 (DSREG_E_DIRECTORY_FAILURE) | The registration service returned a directory error, for example the device object isn’t found yet. | Check Server ErrorCode. If the device simply hasn’t synced, wait for the next Entra Connect sync and retry. |
| 0x801c0002, 0x801c0006 | Device authentication or internal service error. | Read the Server ErrorCode and Server Message for the specific cause. |
| 0x80090016, 0x80290407, 0x80090031 | TPM key or lockout problem. | Check the TPM in tpm.msc; a TPM firmware update from the PC maker often helps. For 0x80090031 (lockout), wait and retry later. |
If the server message mentions AADSTS90002 (tenant not found), the tenant ID in the SCP is wrong and needs correcting in Microsoft Entra Connect.
Retry the join
After fixing the cause, you don’t have to wait for the next sign-in. In Task Scheduler, go to Task Scheduler Library > Microsoft > Windows > Workplace Join, right-click Automatic-Device-Join and select Run. Then run dsregcmd /status again. A restart and sign-in does the same thing.
If the device registers but management still fails afterwards, see device management could not be enabled.
Related guides
- Device management could not be enabled: how to fix it
- Group Policy Management Console in Windows 11
- How to check the last login in Windows with Event Viewer
- “Your organization has deleted this device” (700003): how to fix it
Official sources: for more detail, see these pages:
- Microsoft Learn: Troubleshoot hybrid Microsoft Entra joined devices
- Microsoft Learn: Configure hybrid Microsoft Entra join
Frequently asked questions
Is this error dangerous?
No. It only means the PC isn’t registered in Microsoft Entra ID. On networks that don’t use hybrid join, nothing depends on it.
Why does it appear on a home PC?
It shouldn’t, because home PCs aren’t domain-joined. If you see it on a personal PC, check Settings > Accounts > Access work or school for an old work account and disconnect it if you no longer need it.
Can I just disable the scheduled task?
You can, but the Group Policy setting above is the supported way and is easier to reverse across many PCs.
How long does a new device take to register?
With a sync-based join, the computer object has to sync to Microsoft Entra ID first, so the first attempts can fail until the next Entra Connect sync completes. That’s expected.
Leave a Reply