User Device Registration event 304: what it means and how to fix it

Applies to: Windows 11 and Windows 10 devices joined to an Active Directory domain. Most steps need administrator rights; the policy and SCP fixes need domain admin rights.

What event 304 means

You’ll find it in Event Viewer under Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin. It usually reads “Automatic registration failed at join phase”, followed by an exit code and a server error, and it often appears together with event 307 (“Automatic registration failed”) and event 305.

The events come from the scheduled task Automatic-Device-Join (in Task Scheduler under Microsoft > Windows > Workplace Join). On domain-joined PCs it runs at sign-in and on a schedule, and tries to complete Microsoft Entra hybrid join so the device is known to both on-premises Active Directory and Microsoft Entra ID (formerly Azure AD).

Does it matter?

• Your organization doesn’t use hybrid join: the task still tries, fails, and logs 304 and 307. Nothing is broken. You can leave it or stop it (see below).
• Right after Windows was deployed or reimaged: Microsoft documents that 304 and 307 can be logged when the task runs before the device can reach a domain controller or finish setup. If later attempts succeed, ignore the early events.
• Your organization relies on hybrid join (Conditional Access, Intune co-management, Windows Hello for Business): repeated 304 events mean the device isn’t registered, and users may be blocked from Microsoft 365 apps or see PIN and sign-in problems. Fix it.

Check the device’s join status

Open Command Prompt (no admin needed) and run:

dsregcmd /status

• In Device State, DomainJoined : YES and AzureAdJoined : YES together mean hybrid join has succeeded, so older 304 events no longer matter.
• AzureAdJoined : NO on a domain-joined PC means the join hasn’t completed. Look at the Diagnostic Data section, which lists the last attempt, the phase that failed and the error code.
• Compare that code with the one in event 304. They should match and point to the same cause.

Common error codes in the event

Microsoft’s hybrid join troubleshooting guide (linked below) lists every code. These are the ones seen most often:

• 0x801c001d: Windows couldn’t read the service connection point (SCP) in Active Directory, so it doesn’t know which Microsoft Entra tenant to join. Either the SCP was never configured (common when hybrid join isn’t used) or the device can’t query Active Directory.
• 0x80070774: no domain controller could be reached. Typical on laptops that start off the corporate network or before VPN connects.
• 0x801c03f2: Microsoft Entra ID doesn’t know the device yet. Microsoft Entra Connect hasn’t synced its computer object, often because the device’s organizational unit (OU) isn’t in the sync scope. It can also just mean the next sync hasn’t run.

If your code isn’t listed here, search for it in the Microsoft guide; the Diagnostic Data section of dsregcmd /status usually names the reason in plain words too.

Fix it when you use hybrid join

1. Connect to the domain network (or VPN) and sign out and in again, or restart. The task retries at sign-in.
2. Check the SCP: on a domain controller or management PC, confirm hybrid join is configured in Microsoft Entra Connect (Configure device options), which creates the SCP. Without it, every device logs 0x801c001d.
3. Check sync scope: make sure the computer’s OU is synced by Microsoft Entra Connect, then wait for the next sync cycle (or ask your admin to run a delta sync).
4. Check internet access for the device, including through a proxy: it must reach Microsoft’s registration and sign-in endpoints such as enterpriseregistration.windows.net and login.microsoftonline.com as the computer account, not just as the user.
5. Retry: in Task Scheduler, open Task Scheduler Library > Microsoft > Windows > Workplace Join, right-click Automatic-Device-Join and choose Run, then check dsregcmd /status again.

If the PC also says the trust relationship with the domain failed, fix that first; see the trust relationship between this workstation and the primary domain failed. Windows Hello PIN errors on the same devices often clear once registration works; see Windows Hello PIN “This option is currently unavailable”.

Stop it when you don’t use hybrid join

For all domain PCs, use Group Policy. Open the Group Policy Management Console, edit a GPO linked to the computers’ OU, and go to:

Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration

Set Register domain joined computers as devices to Disabled. After the next policy refresh (gpupdate /force to speed it up), the PCs stop attempting hybrid join and the 304 and 307 events stop.

On a single PC you can instead disable the Automatic-Device-Join task in Task Scheduler, but a policy is better in a managed network because it’s documented and easy to reverse. Don’t do either if your organization plans to use hybrid join, Intune or Windows Hello for Business; check with whoever manages Microsoft 365 first.

Related guides

• “The trust relationship between this workstation and the primary domain failed”: how to fix it
• Group Policy Management Console on Windows 11: how to install and open it
• Windows Hello PIN “This Option Is Currently Unavailable”: How to Fix It
• Automatic registration failed at join phase: what it means and how to fix it

Official sources: for more detail, see Microsoft’s own pages:

• Microsoft Learn: Event ID 307 and Event ID 304 are logged after you deploy Windows
• Microsoft Learn: Troubleshoot Microsoft Entra hybrid joined devices

Frequently asked questions

Is event 304 a security problem?

No. It only records a failed attempt to register the device in Microsoft Entra ID. It doesn’t mean someone is attacking the PC.

Why do I see it on my home PC?

It’s rare on PCs that aren’t domain-joined. If you see it after adding a work or school account, the registration of that account failed; removing and re-adding the account in Settings > Accounts > Access work or school usually fixes it.

Can I clear the old events?

You can clear the log in Event Viewer, but there’s no need. Once registration works or the policy is disabled, new 304 events stop appearing.