Scope: This article covers Windows Current devices (Windows 10 1607+ / Windows 11) performing Hybrid Entra Join via Entra Connect. It does not cover Workplace Join (personal device registration) or pure Entra Join. All commands assume you are running PowerShell or CMD as a local administrator on the affected machine, or deploying remediation via Group Policy / Intune.

# Run as the logged-on user (not elevated) to capture SSO/PRT state
# Run as SYSTEM or elevated to see machine-level certificate state
dsregcmd /status

# Pipe to a file for remote review
dsregcmd /status | Out-File "C:\Temp\dsregcmd-output.txt" -Encoding UTF8

# Parse key fields programmatically
$dsreg = dsregcmd /status
$fields = @(
    'AzureAdJoined',
    'DomainJoined',
    'WorkplaceJoined',
    'AzureAdPrt',
    'TenantName',
    'DeviceId',
    'KeyContainerId',
    'DomainName'
)
foreach ($field in $fields) {
    $line = $dsreg | Where-Object { $_ -match "^\s+$field\s+:" }
    if ($line) { Write-Host $line.Trim() }
}

# Pull the last 50 User Device Registration events — run elevated
$logName = 'Microsoft-Windows-User Device Registration/Admin'
Get-WinEvent -LogName $logName -MaxEvents 50 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-Table -AutoSize -Wrap

# Filter to registration-critical event IDs only
$criticalIds = @(201, 220, 304, 305, 307, 335)
Get-WinEvent -LogName $logName -MaxEvents 200 -ErrorAction SilentlyContinue |
    Where-Object { $_.Id -in $criticalIds } |
    Select-Object TimeCreated, Id, LevelDisplayName,
        @{ N='Summary'; E={ $_.Message -replace '\s+',' ' } } |
    Format-List

Warning: Running dsregcmd /leave will remove the device's existing Entra registration and PRT (Primary Refresh Token). Do not run this on a machine that is only Entra Joined (non-hybrid) — it will break sign-in. On Hybrid Join machines, the domain join is preserved and sign-in continues via NTLM/Kerberos.

# ── PHASE 1: Run in an ELEVATED PowerShell window ──────────────────────────

# Leave current registration
dsregcmd /leave

# Remove stale Workplace Join certificates from machine store
Get-ChildItem 'Cert:\LocalMachine\My' |
    Where-Object { $_.Issuer -like '*MS-Organization-Access*' -or
                   $_.Issuer -like '*MS-Organization-P2P-Access*' } |
    ForEach-Object {
        Write-Host "Removing cert: $($_.Subject) [$($_.Thumbprint)]" -ForegroundColor Yellow
        Remove-Item $_.PSPath -Force
    }

# Restart — required for TPM key attestation state to clear
Write-Host "Restarting in 30 seconds. Save your work." -ForegroundColor Cyan
Start-Sleep -Seconds 30
Restart-Computer -Force

# ── PHASE 2: After restart, in a NON-ELEVATED window (as the end user) ──────

# Trigger the Automatic-Device-Join scheduled task immediately
Start-ScheduledTask -TaskPath '\Microsoft\Windows\Workplace Join\' `
                    -TaskName 'Automatic-Device-Join'

# Wait briefly then verify
Start-Sleep -Seconds 30
dsregcmd /status | Select-String -Pattern 'AzureAdJoined|DomainJoined|AzureAdPrt|DeviceId'

Warning: The steps below modify Active Directory computer object attributes. Run from a domain controller or a machine with the AD PowerShell module (RSAT). Verify the computer name before clearing the attribute.

Import-Module ActiveDirectory

$computerName = 'COMPUTER01'   # Replace with target hostname

# Inspect current values
$computer = Get-ADComputer $computerName -Properties 'msDS-DeviceID', 'msDS-KeyCredentialLink'
Write-Host "Current msDS-DeviceID : $($computer.'msDS-DeviceID')"
Write-Host "KeyCredentialLink count: $($computer.'msDS-KeyCredentialLink'.Count)"

# Clear the stale DeviceID so Entra Connect syncs a clean object
Set-ADComputer $computerName -Clear 'msDS-DeviceID'

# Optionally delete the stale Entra device object via Graph before next sync
# (requires Microsoft.Graph PowerShell module and Device.ReadWrite.All)
Connect-MgGraph -Scopes 'Device.ReadWrite.All'
$entraDevice = Get-MgDevice -Filter "displayName eq '$computerName'" -All |
    Where-Object { $_.TrustType -eq 'ServerAd' -and $_.ApproximateLastSignInDateTime -lt (Get-Date).AddDays(-30) }
if ($entraDevice) {
    Write-Host "Deleting stale Entra object: $($entraDevice.Id)" -ForegroundColor Yellow
    Remove-MgDevice -DeviceId $entraDevice.Id
}

# Trigger Entra Connect delta sync to project the cleaned object
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

Tip — OU Move Scenario: If you recently moved a computer object to a different OU, Entra Connect's scoping filter may have excluded it temporarily. Run a Full Sync (Start-ADSyncSyncCycle -PolicyType Initial) from the Entra Connect server after an OU move. Delta syncs may not re-evaluate scoping filters for existing objects.

# Run elevated — enumerates and removes WPJ/Hybrid cert conflicts
$storePaths = @('Cert:\LocalMachine\My', 'Cert:\CurrentUser\My')
$conflictIssuers = @('MS-Organization-Access', 'MS-Organization-P2P-Access')

foreach ($storePath in $storePaths) {
    Write-Host "`nScanning: $storePath" -ForegroundColor Cyan
    Get-ChildItem $storePath -ErrorAction SilentlyContinue |
        Where-Object { $issuer = $_.Issuer; $conflictIssuers | Where-Object { $issuer -like "*$_*" } } |
        ForEach-Object {
            Write-Host "  [-] Removing: $($_.Subject) | Issued: $($_.NotBefore) | Thumbprint: $($_.Thumbprint)" -ForegroundColor Yellow
            Remove-Item $_.PSPath -Force
        }
}
Write-Host "`nDone. Restart the device then trigger Automatic-Device-Join task." -ForegroundColor Green

#Requires -RunAsAdministrator
<#
   GPO Startup Script — Hybrid Join Remediation
   Runs ONCE per device. Sets a registry flag after success to prevent re-running.
   Link GPO to affected OU; remove link once all devices are remediated.
#>

$regPath  = 'HKLM:\SOFTWARE\IT\HybridJoinRemediation'
$regValue = 'RemediationComplete'
$logFile  = 'C:\Windows\Temp\HybridJoinFix.log'

function Write-Log {
    param([string]$Message)
    $ts = (Get-Date).ToString('yyyy-MM-dd HH:mm:ss')
    "[$ts] $Message" | Tee-Object -FilePath $logFile -Append
}

# Skip if already remediated
if ((Get-ItemProperty $regPath -Name $regValue -ErrorAction SilentlyContinue).$regValue -eq 1) {
    Write-Log "Remediation already complete — skipping."
    exit 0
}

Write-Log "Starting Hybrid Join remediation on $env:COMPUTERNAME"

# Step 1 — Leave current Entra device registration
Write-Log "Running dsregcmd /leave"
$leaveResult = dsregcmd /leave 2>&1
Write-Log $leaveResult

# Step 2 — Remove conflicting WPJ certificates
Write-Log "Removing WPJ certificates from LocalMachine\My"
Get-ChildItem 'Cert:\LocalMachine\My' -ErrorAction SilentlyContinue |
    Where-Object { $_.Issuer -like '*MS-Organization*' } |
    ForEach-Object {
        Write-Log "  Removing: $($_.Subject) [$($_.Thumbprint)]"
        Remove-Item $_.PSPath -Force -ErrorAction SilentlyContinue
    }

# Step 3 — Enable the Automatic-Device-Join scheduled task if disabled
$task = Get-ScheduledTask -TaskPath '\Microsoft\Windows\Workplace Join\' `
                          -TaskName 'Automatic-Device-Join' -ErrorAction SilentlyContinue
if ($task -and $task.State -eq 'Disabled') {
    Write-Log "Re-enabling Automatic-Device-Join task"
    Enable-ScheduledTask -TaskPath '\Microsoft\Windows\Workplace Join\' -TaskName 'Automatic-Device-Join'
}

# Step 4 — Mark complete so script doesn't re-run
if (-not (Test-Path $regPath)) { New-Item $regPath -Force | Out-Null }
Set-ItemProperty $regPath -Name $regValue -Value 1 -Type DWord

Write-Log "Remediation script complete. Device will re-register on next user login."

Monitoring bulk progress: After 24–48 hours, query Entra for devices still in Pending state using Get-MgDevice -Filter "trustType eq 'ServerAd' and accountEnabled eq false" — accountEnabled=false is how Entra surfaces the Pending state via Graph API. Cross-reference against your AD OU scope to measure remediation progress.

# Run on the Entra Connect server — requires ADSync module
Import-Module ADSync

# Attribute changes (msDS-DeviceID cleared, object deleted/recreated)
Start-ADSyncSyncCycle -PolicyType Delta
Write-Host "Delta sync triggered. Check status:"

# Monitor sync status
Get-ADSyncConnectorRunStatus

# OU scope changes — use Initial (full) sync
# Start-ADSyncSyncCycle -PolicyType Initial

# Check last sync errors
Get-ADSyncRunStepResult | Where-Object { $_.StepResult -ne 'Success' } |
    Select-Object ConnectorName, RunProfileName, StepResult, StartDateTime, EndDateTime |
    Format-Table -AutoSize

# Run as the logged-on user (non-elevated) for full PRT state
$raw = dsregcmd /status

$checks = @{
    'AzureAdJoined'    = 'YES'
    'DomainJoined'     = 'YES'
    'WorkplaceJoined'  = 'NO'
    'AzureAdPrt'       = 'YES'
}

$allPass = $true
foreach ($check in $checks.GetEnumerator()) {
    $line   = $raw | Select-String "^\s+$($check.Key)\s+:"
    $actual = if ($line) { ($line -split ':', 2)[1].Trim() } else { 'NOT FOUND' }
    $pass   = $actual -eq $check.Value
    $colour = if ($pass) { 'Green' } else { 'Red' ; $allPass = $false }
    Write-Host ("  {0,-20} Expected: {1,-4}  Actual: {2}" -f $check.Key, $check.Value, $actual) -ForegroundColor $colour
}

if ($allPass) {
    Write-Host "`n[PASS] Device is Hybrid Entra Joined and PRT acquired." -ForegroundColor Green
} else {
    Write-Host "`n[FAIL] One or more checks failed. Review above output." -ForegroundColor Red
}

Success indicators: AzureAdJoined = YES, DomainJoined = YES, WorkplaceJoined = NO, AzureAdPrt = YES, and a populated DeviceId GUID. The device should now appear in the Entra portal as Hybrid Azure AD joined (not Pending) within one delta sync cycle (~30 minutes by default).

SSL Inspection Warning: If your proxy performs TLS inspection, the DRS endpoints must be bypassed. The device registration handshake includes certificate pinning and mutual TLS elements that break when intercepted by a corporate proxy. Add enterpriseregistration.windows.net and login.microsoftonline.com to your SSL inspection bypass list.