Device Registration Troubleshooter Tool

• Code Sample
• 02/12/2024
• 4 contributors

Coming from the fact that it is not so easy to troubleshoot device registration issues and it does take some time, but now, using Device Registration Troubleshooter tool it is not complex anymore :)

DSRegTool PowerShell is a comprehensive tool that performs more than 50 different tests that helps you to identify and fix the most common device registration issues for all join types (Microsoft Entra hybrid join, Microsoft Entra join and Microsoft Entra Register).

Script requirements

You can run DSRegTool as a normal user, except with option #3 and option #7 where you need to run DSRegTool with a user who has local admin permissions

How to run the script

Download and run the DSRegTool.ps1 script from this GitHub repo.

Why is this script useful?

DSRegTool facilitates troubleshooting device registration issues for different join types

What are tests DSRegTool perform?

1- Troubleshoot Microsoft Entra Register

• Testing OS version
• Testing if the device is registered to Entra ID by the signed in user
• Testing Device Registration endpoints connectivity
• Testing Device Registration Service
• Testing if the device exists on Entra ID
• Testing if the device is enabled on Entra ID

2- Troubleshoot Microsoft Entra join device device

• Testing OS version
• Testing if the device joined to the local domain
• Testing if the device is joined to Entra ID
• Testing if you signed in user is a Built-in Administrator account
• Testing if the signed in user has local admin permissions
• Testing Device Registration endpoints connectivity
• Testing Device Registration Service
• Testing if the device exists on Entra ID
• Testing if the device is enabled on Entra ID

3- Troubleshoot Microsoft Entra hybrid join

• Testing OS version
• Testing if the device joined to the local domain
• Testing if the device is joined to Entra ID
• Testing Automatic-Device-Join task scheduler
• Testing Domain Controller connectivity
• Testing Service Connection Point (SCP) configuration for both client and domain sides
• Testing Device Registration endpoints connectivity under system context:
  • Testing connectivity over winHTTP proxy (considering if domain is bypassed)
  • Testing connectivity over winInet proxy (considering if domain is bypassed)
• Testing the following with Federated domain:
  • Testing MEX endpoint (for Federated domains)
  • Testing windowstransport endpoints (for Federated domains)
  • Testing device authentication (for ADFS)
  • Testing device registration claim rules configuration (for ADFS)
  • If federated join flow failed, checking sync join flow
  • Testing OS version if it supports fallback to sync join
  • Testing fallback to sync join configuration enablement
• Testing the following with Managed domain / Sync join flow:
  • Testing if the device synced successfully to Entra ID (for Managed domains)
  • Testing userCertificate attribute under AD computer object
  • Testing self-signed certificate validity
  • Testing if the device synced to Entra ID
• Testing Device Registration Service
• Test if the device exists on Entra ID
• Test if the device enabled on Entra ID
• Test if the device is not pending on Entra ID
• Testing if device is stale

4- Verify Service Connection Point (SCP)

• Testing client-side registry setting
• Testing client-side registry configuration (tenantID, DomainName)
• Testing Domain Controller connectivity
• Testing Service Connection Point (SCP) on configuration partition
• Testing Service Connection Point (SCP) configuration

5- Verify the health status of the device

• Checks OS version
• Checks if the device joined to the local domain
• Checks if the device is joined to Entra ID
• Checks if the device hybrid, Entra ID Join or Microsoft Entra Register
• Checks the device certificate configuration.
• Checks if the device exists on Entra ID
• Checks if the device enabled on Entra ID
• Checks if the device is not pending on Entra ID
• Shows the health status for the device
• Provides recommendations to fix unhealthy devices

6- Verify Primary Refresh Token (PRT)

• Checks OS version
• Checks if the device joined to the local domain
• Testing if the device is Microsoft Entra hybrid join
• Testing if the device is Microsoft Entra join device
• Testing Entra ID PRT (DJ++ or ADDJ)
• Testing Enterprise PRT (DJ++)
• Testing if the device is workplace joined
• Testing the registry configuration (WPJ)

7- Collect the logs

• If DSRegTool is running with elevated privileges, start log collection. Otherwise, tool shows action plan to collect the logs using Feedback hub.

User experience

Frequently asked questions

Does the script change anything?

No, It just retrieves data.

Does the script require any PowerShell module to be installed?

No, the script does not require any PowerShell module.

Will the tool fix the issue when it detects it?

No, it identifies the issue and suggest recommended steps to fix it.

What are the logs being collected by option #7?

Here is log collection output file reference: