If you troubleshoot Windows Hello for Business (WHfB), Entra join, or on-premises single sign-on, one command answers more questions than any portal: dsregcmd /status. The problem is that its output is a wall of forty-plus fields with almost no explanation, and most admins read only the three lines they already recognise. This is the field-by-field reference - every section, what each line means, and which values are "good" - so you can read the whole picture instead of guessing at it.
dsregcmd /status as the signed-in user, not elevated. Several of the most useful fields - NgcSet, AzureAdPrt, OnPremTgt - only populate in the user context. Run it from an elevated prompt and those read blank or wrong, which sends you chasing problems that are not there.The problem: forty fields and no legend
Most admins read only the three lines of dsregcmd /status they already recognise and guess at the rest. That is how a device with a clear answer in front of you still takes an hour to diagnose - the information is there, unlabelled.
Why it happens: the output spans several sections with no explanation
The command dumps Device State, Device Details, Tenant Details, User State, SSO State, Diagnostic Data and the NGC Prerequisite Check back to back, with no descriptions. Each section answers a different question, and the fields you need for Windows Hello for Business (WHfB) are scattered across three of them.
How to verify: run it in the user context first
Run dsregcmd /status as the signed-in user, not elevated - NgcSet, AzureAdPrt and OnPremTgt only populate in the user context. From an elevated prompt they read blank and send you chasing problems that do not exist.
The fix: read it section by section
Section 1 - Device State: what kind of join is this?
The top block answers "how is this device registered?" Three booleans combine into the join type, and this truth table is worth memorising because half of all WHfB questions start with getting the join type right:
| AzureAdJoined | EnterpriseJoined | DomainJoined | = Device state |
|---|---|---|---|
| YES | NO | NO | Microsoft Entra joined |
| NO | NO | YES | Domain joined (on-prem only) |
| YES | NO | YES | Microsoft Entra hybrid joined |
| NO | YES | YES | On-premises DRS joined |
Note: the Microsoft Entra registered (Workplace Joined) state is not shown here - it appears in the User State section under WorkplaceJoined.
Section 2 - Device Details: the device identity and its key
Shown only for Entra joined / hybrid joined devices. The fields that matter for WHfB security:
DeviceId- the device's unique ID in the tenant (this is what you search for in the Entra portal).KeyProvider- Hardware or Software. Where the device key lives.TpmProtected-YESmeans the device private key is in the TPM.NOis a flag worth chasing.DeviceAuthStatus-SUCCESSmeans the device is present and enabled in Entra ID.FAILED. Device is either disabled or deletedexplains a whole class of sudden sign-in failures.
Section 3 - User State: is there a Hello credential?
This is the WHfB heart of the output. Run in the user context, it tells you whether Hello is set up and how it can be reset:
NgcSet-YESif a Windows Hello key is set for the logged-in user. This is the "is Hello provisioned?" answer.NgcKeyId- the key's ID (matches what you see server-side).CanReset-DestructiveOnly,NonDestructiveOnly,DestructiveAndNonDestructive, orUnknown. This tells you exactly which PIN-reset experience the user gets.
Section 4 - SSO State: the tokens that make SSO work
The single-sign-on block, also user-context. These are the fields you read when "cloud works, on-prem prompts" (or vice versa):
AzureAdPrt-YESif a Primary Refresh Token is present. No PRT = no SSO, and nothing on-prem works either.OnPremTgt/CloudTgt- cloud Kerberos tickets for on-prem and cloud resources respectively. On a cloud-trust device,OnPremTgt : YESis your proof that the partial-to-full TGT exchange succeeded.- When a PRT acquisition fails, an
AcquirePrtDiagnostics : PRESENTblock appears with theAttempt Status(an HRESULT),Credential Type(Password or NGC), and the exactServer Error Code- the real reason, in plain sight.
CloudTGT; from 23H2 it is OnPremTGT. If you are reading older runbooks or comparing across OS versions, that rename trips people up - they are the same thing.Section 5 - NGC Prerequisite Check: why Hello did (not) provision
This section only appears when Hello has not yet successfully provisioned - which makes it the single most useful block for "why isn't the user getting a PIN prompt?" Each line is a prerequisite, and the first NO is your answer:
The fields decode cleanly: IsDeviceJoined, IsUserAzureAD, PolicyEnabled, PostLogonEnabled (NO here means a custom mechanism, not the platform, triggers enrolment), DeviceEligible (fails when there is no usable TPM and you require one), SessionIsNotRemote (Hello does not provision inside an RDP session), and PreReqResult - WillProvision means Hello enrolment will fire as a post-login task at next sign-in.
SessionIsNotRemote : NO is the answer to a very common false alarm. Hello will not provision inside a Remote Desktop session - so an admin testing WHfB over RDP will see it "fail" every time. Test provisioning at the physical console, not through RDP.dsregcmd /status top to bottom in order: join type → device key/TPM → NgcSet → PRT/TGT → (if Hello is missing) the prerequisite check. Each section narrows the problem. The prerequisite check in particular is self-diagnosing - the first NO from the top is almost always the root cause, and it names itself.Proof it worked: you diagnose from the output, not a guess
You are reading it correctly when a single run turns "Hello is broken" into a specific answer - "hybrid joined, NgcSet YES, AzureAdPrt YES, OnPremTgt NO" points straight at the on-prem ticket exchange, and the NGC Prerequisite Check names the first failing prerequisite for you. Section by section, top to bottom, the output diagnoses itself.
References
- Troubleshoot devices by using the dsregcmd command (full field reference)
- What is a Primary Refresh Token
- How Windows Hello for Business works
- What is a device identity (join types)
Script for this post is in Daily-Tasks.