Dsregcmd Exe Explained: Your Guide to Device Registration

Dsregcmd.exe is the native Windows command-line utility used to query, manage, and troubleshoot device registration status with Microsoft Entra ID and hybrid Active Directory infrastructure. Executed from Command Prompt or PowerShell, it displays crucial device identity states, Primary Refresh Token health, system certificates, and single sign-on authentication details.

Located at C:WindowsSystem32dsregcmd.exe, this binary comes preinstalled on modern Windows desktop and server editions, including Windows 10, Windows 11, and Windows Server versions. Systems administrators and desktop support engineers rely on dsregcmd.exe to diagnose single sign-on (SSO) failures, enforce Conditional Access compliance, and verify hardware-bound trust credentials. Understanding its parameters and reading its structured output allows you to pinpoint identity failures without relying on external diagnostic packages.

How device registration models affect dsregcmd output

Before interpreting the output of dsregcmd.exe, you must understand how Windows categorizes device identities within Microsoft Entra ID (formerly Azure Active Directory). The utility queries local registry keys, machine certificate stores, and local security authority endpoints to report which of three primary registration states applies to the endpoint.

The registration model determines how the machine authenticates to cloud services, how management policies apply, and what identity tokens Windows issues to signed-in users.

Registration Type	Device Ownership	Primary Identity Source	Management Model	dsregcmd Status Flags
Entra ID Joined	Organization	Microsoft Entra ID (Cloud)	Microsoft Intune / Cloud MDM	AzureAdJoined : YES DomainJoined : NO
Hybrid Entra ID Joined	Organization	Active Directory & Entra ID	Group Policy & Intune	AzureAdJoined : YES DomainJoined : YES
Entra Registered	Personal / BYOD	Local / Personal Account	Conditional Access / MAM	WorkplaceJoined : YES AzureAdJoined : NO

Entra ID Joined

Devices joined purely to Entra ID connect directly to Microsoft cloud infrastructure without depending on on-premises Active Directory domain controllers. Common in cloud-first environments, remote workforces, and modern enterprise fleets managed by Microsoft Intune, these devices sign in using cloud accounts. Running dsregcmd /status on a cloud-only joined device displays AzureAdJoined: YES and DomainJoined: NO.

Hybrid Entra ID Joined

Hybrid devices belong simultaneously to an on-premises Active Directory domain and Microsoft Entra ID. Organizations transitioning legacy infrastructure rely on hybrid joins so users can authenticate against local domain controllers for legacy file shares while acquiring cloud tokens for Microsoft 365 services. Devices register automatically through Azure AD Connect sync and Service Connection Point (SCP) configuration in Active Directory. On these endpoints, dsregcmd /status reports AzureAdJoined: YES and DomainJoined: YES.

Entra Registered (Workplace Joined)

Workplace registration applies primarily to personally owned devices (Bring Your Own Device) or unmanaged corporate assets. When a user adds a work or school account inside Windows settings, the OS registers the device hardware with Entra ID to grant conditional access to organizational resources without taking complete administrative control of the physical PC. Running dsregcmd /status displays WorkplaceJoined: YES, while both AzureAdJoined and DomainJoined report NO.

How to run dsregcmd.exe and interpret the output

You execute dsregcmd.exe from standard Command Prompt, PowerShell, or Windows Terminal sessions. While basic status checks work in standard user context, running the utility within an elevated administrator console yields hardware cryptographic and certificate details that standard context omits.

Executing dsregcmd /status outputs several distinct sections. Each section presents structured key-value pairs representing a specific layer of the device’s identity stack.

Device State section

The Device State section outlines the fundamental join architecture of the machine:

• AzureAdJoined: Set to YES if the device connects to Entra ID; otherwise NO.
• EnterpriseJoined: Displays YES if the machine joins an on-premises workplace trust (used in legacy DRS environments).
• DomainJoined: Set to YES if joined to a local Active Directory domain.
• DomainName: Shows the NetBIOS or FQDN of the local domain controller if DomainJoined is YES.
• DeviceId: The unique GUID assigned to the device object in Entra ID. This ID must match the device record in the tenant administrative portal.

Device Details section

This section verifies local hardware authentication health:

• DeviceAuthStatus: Indicates whether Entra ID recognizes the device object as valid (SUCCESS). If set to FAILED, the cloud directory has invalidated or deleted the record.
• IsUserAzureAD: Reports whether the currently signed-in user is an Entra ID user account.
• IsDeviceJoined: Indicates whether the physical device holds a valid local machine registration key.

Tenant Information section

Tenant Information confirms which cloud organization controls the device registration:

• TenantId: The unique directory GUID of your Entra ID tenant.
• TenantName: The primary domain name of the cloud tenant (such as company.onmicrosoft.com).
• AuthCodeUrl / AccessTokenUrl: OAuth endpoints used by Windows for token negotiation.
• MdmUrl / MdmComplianceUrl: Management endpoints (such as Microsoft Intune) assigned to manage device policy compliance.

User State section

The User State section details the identity context of the currently logged-in account:

• NgcSet: Displays YES if Windows Hello for Business (Next Generation Credentials) is configured for the signed-in user.
• WorkplaceJoined: Shows YES if a secondary workplace account is registered on the system.
• WamDefaultSet: Indicates whether Web Account Manager (WAM) defaults to Entra ID authentication workflows.

SSO State section

Single Sign-On health depends on the Primary Refresh Token (PRT). This section provides essential diagnostic indicators:

• AzureAdPrt: Displays YES when a valid PRT exists. If set to NO, user single sign-on across Microsoft 365 applications will fail or prompt for repetitive credential entry.
• AzureAdPrtAuthority: The authority login endpoint issuing the token (e.g., https://login.microsoftonline.com/your-tenant-id).
• AzureAdPrtExpiryTime: The exact timestamp when the current PRT token expires unless refreshed.
• EnterprisePrt: Shows YES if an on-premises Active Directory Federation Services (ADFS) PRT is active.

Diagnostic Data and Key Provider details

Elevated command sessions display cryptographic key containers, Platform Crypto Provider details, and Trusted Platform Module (TPM) bindings. When TpmProtected shows YES, the private keys backing device identity and user PRTs are sealed inside the system TPM hardware chip, protecting them against credential extraction attacks.

Essential dsregcmd commands and options

While /status is the standard diagnostic command, dsregcmd.exe provides specialized switches to inspect certificates, trigger token updates, manage workplace ties, and generate diagnostic traces.

dsregcmd /status: Primary diagnostic baseline

Executing dsregcmd /status gives an immediate summary of device identity and token status. Use this command as the initial step when troubleshooting user reports involving SSO prompts, Conditional Access blocks, or application authentication errors.

If AzureAdJoined displays YES but AzureAdPrt displays NO, the device identity exists in the cloud, but the active user session failed to acquire an interactive SSO token during sign-in.

dsregcmd /showcerts: Inspecting cryptographic trust

Device registration relies on x509 certificates stored in the local machine certificate store (Cert:LocalMachineMy). Running dsregcmd /showcerts lists all certificates associated with device identity and transport keys.

The output displays certificate thumbprints, issuer details, subject names, and valid date ranges (Valid From and Valid To). If the device identity certificate issued by MS-Organization-Access has expired, Entra ID rejects device authentication requests, causing access blocks.

dsregcmd /forcerefreshprt: Force token renewal

The Primary Refresh Token automatically updates during standard operating system workflows. However, network interruptions or changing Conditional Access policies can leave a stale PRT in memory.

Running dsregcmd /forcerefreshprt instructs the Cloud Application Provider (LSA) to immediately contact Entra ID endpoints and request a fresh PRT token.

According to Microsoft Learn documentation (updated early 2026), triggering a PRT refresh forces re-evaluation of user and device claims without requiring the user to log out or reboot the computer.

dsregcmd /join and dsregcmd /leave: Managing workplace registration

The /join and /leave switches manage workplace registration states for BYOD and unmanaged devices:

• dsregcmd /leave: Initiates unregistration from Entra ID. For Workplace Joined machines, running this command cleanly removes local certificates and registry pointers.
• dsregcmd /join: Triggers the client registration task to attempt device registration against configured endpoints.

Do not run dsregcmd /leave on automated Hybrid Entra ID Joined machines unless you intend to reset the device trust completely. Hybrid unjoining requires administrative workflows and clearing computer attributes in local Active Directory.

dsregcmd /debug: Generating verbose diagnostic logs

When standard status output fails to explain a persistent registration issue, appending the /debug switch reveals hidden system operations:

The debug output logs precise HTTP response status codes, API calls to client registration endpoints, registry query results, and cryptographic key generation steps. Combining /debug output with Windows Event Viewer entries provides a detailed trace of registration attempts.

How to fix common dsregcmd errors and registration failures

Understanding error patterns reported by dsregcmd.exe lets you quickly resolve device authentication issues. Here are the most frequent failure modes encountered in enterprise environments and their corrective workflows.

AzureAdPrt shows NO or token is invalid

When dsregcmd /status reports AzureAdPrt : NO, single sign-on fails across desktop apps like Microsoft Teams, Outlook, and OneDrive, causing prompt loops.

Diagnostic steps:

1. Check WamDefaultSet in dsregcmd /status. If set to NO, Web Account Manager is misconfigured.
2. Verify if a proxy server or network firewall blocks outbound traffic to https://login.microsoftonline.com or https://device.login.microsoftonline.com.
3. Check system time synchronization. A local device clock skewed by more than five minutes relative to UTC breaks token validation.

Fix action:

Run an elevated Command Prompt session and attempt a manual PRT refresh:

dsregcmd /forcerefreshprt

If the token remains NO, lock the Windows session (Win + L) and log back in, or execute gpupdate /force if group policies govern local LSA parameters. For deeper troubleshooting, using official Microsoft Entra diagnostic routines can identify blocked Web Account Manager plugins.

Device certificate missing or expired

If dsregcmd /showcerts outputs no certificates or lists a certificate whose Valid To date is in the past, device authentication calls fail with HTTP 401 or TLS errors.

Diagnostic steps:

Run PowerShell as Administrator and inspect local machine certificates:

Get-ChildItem -Path Cert:LocalMachineMy | Where-Object { $_.Issuer -like "*MS-Organization-Access*" }

If no certificate returns, or if NotAfter shows an expired timestamp, the local computer certificate store lacks valid trust credentials.

Fix action:

For Hybrid joined endpoints, force the automatic device registration scheduled task to re-run:

Start-ScheduledTask -TaskName "MicrosoftWindowsWorkplace JoinAutomatic-Device-Join"

Allow two minutes, then rerun dsregcmd /showcerts to verify that a renewed certificate issued by MS-Organization-Access exists.

Hybrid join stuck (AzureAdJoined: NO, DomainJoined: YES)

In hybrid deployments, new computer objects frequently fail to complete Entra ID registration, remaining strictly domain-joined.

Diagnostic steps:

1. Verify Service Connection Point (SCP) configuration in local Active Directory using Active Directory Service Interfaces (ADSI Edit). SCP must point to your correct Entra ID tenant GUID and domain.
2. Verify that Azure AD Connect synchronizes the local Computer object to Entra ID.

Fix action:

If the device object is absent from the Entra ID Admin Center, open PowerShell on your Azure AD Connect sync server and trigger an immediate delta synchronization cycle:

Start-ADSyncSyncCycle -PolicyType Delta

Once the computer object appears in Entra ID, restart the client workstation or manually launch the Automatic-Device-Join scheduled task.

Network proxy and endpoint blocking

Device registration relies on uninterrupted outbound HTTPS communication between client workstations and Microsoft identity endpoints.

Diagnostic steps:

Run netsh in Command Prompt to inspect SYSTEM context proxy settings:

netsh winhttp show proxy

Because the Automatic Device Join scheduled task runs under the SYSTEM security context rather than the logged-in user, user-level proxy settings do not apply.

Fix action:

Ensure your firewall and proxy configuration permits unauthenticated outbound access on TCP port 443 to these critical endpoints:

• enterpriseregistration.windows.net
• login.microsoftonline.com
• device.login.microsoftonline.com
• autologon.microsoftazuread-sso.com

Automating dsregcmd checks across enterprise environments

Managing thousands of workstations manually using dsregcmd.exe is impractical. Proactive systems administration involves embedding dsregcmd.exe status checks inside PowerShell scripts and fleet management agent policies.

Parsing dsregcmd status using PowerShell

Because dsregcmd /status outputs plain text rather than structured PowerShell objects, you can parse key fields into custom object properties for automated health reporting:

Running a script that extracts key-value pairs allows system tools to evaluate whether AzureAdJoined and AzureAdPrt equal YES across all workstations. Deploying automated monitoring via Microsoft Intune or RMM agents proactively alerts administrators whenever devices drop their PRT token or experience registration drift.

Correlating Event Viewer logs

When diagnosing registration failures, combine dsregcmd.exe output with entries from the Windows Event Viewer. Client registration logs are written to:

Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin

Event ID 304 indicates successful registration, while Event IDs 204, 305, and 307 signal specific TLS, SCP, or token acquisition failures.

Related guides

• Collect2 Exe Error: Ld Returned 1 Exit Status Explained
• Dfrgui Exe Explained: What It Is and How to Use It Safely
• Dokkan Scout Exe: Unmasking Its Purpose and Safe Use

Frequently asked questions

What is the primary purpose of dsregcmd.exe?

The primary purpose of dsregcmd.exe is to query, manage, and diagnose device registration states, Primary Refresh Token (PRT) health, and cloud trust status with Microsoft Entra ID and Active Directory.

Does dsregcmd.exe require administrator privileges to run?

Standard users can run dsregcmd /status to view basic registration state, but running the command from an elevated administrator console is required to inspect hardware certificates, TPM details, and cryptographic keys.

What does it mean if AzureAdPrt shows NO in the status output?

When AzureAdPrt shows NO, the signed-in user session lacks a valid Primary Refresh Token, which breaks single sign-on (SSO) functionality for Microsoft 365 applications and causes Conditional Access policy checks to fail.

Can you use dsregcmd.exe to force a hybrid device to join Microsoft Entra ID?

dsregcmd.exe itself does not execute the underlying sync or join logic for hybrid environments; it initiates client tasks or unjoins workplace registrations. Hybrid joins require Active Directory SCP configuration, Azure AD Connect object sync, and the native Windows Workplace Join scheduled task.