← cd ~/events
// events/201 · Hybrid join
Event ID 201Hybrid join discover phase error
Logged when the discover phase fails: the device could not read the service connection point (SCP) or fetch discovery data from enterpriseregistration.windows.net.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Hybrid join |
What to check
Check the SCP in AD points to the right tenant, and that the device can reach enterpriseregistration.windows.net in system context through any proxy.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x80072efd | WININET_E_CANNOT_CONNECT: could not connect to the server. |
0x80072ee2 | WININET_E_TIMEOUT: network timeout. |
0x801c003a | DSREG_DISCOVERY_TENANT_NOT_FOUND: SCP has the wrong tenant ID or the tenant has no active subscription. |
0x8007000d | E_INVALIDDATA: response could not be parsed, often a proxy returning an HTML sign-in page. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 201 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 201
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Hybrid join events
- Event ID 304: Hybrid join failed (phase and error code)
- Event ID 305: Hybrid join authentication error
- Event ID 307: Hybrid join failure event
- Event ID 204: Hybrid join join-phase error
- Event ID 220: Cannot read the computer object in Active Directory