← cd ~/events
// events/204 · Hybrid join
Event ID 204Hybrid join join-phase error
Logged when the join phase fails, with the error code, HTTP status and message returned by the Device Registration Service.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Hybrid join |
What to check
Use the server error code to find the cause. TPM errors here often mean a cleared TPM or a bad sysprep image.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x801c03f2 | DSREG_E_DIRECTORY_FAILURE: DirectoryError returned by DRS. |
0x801c0002 | DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError returned by DRS. |
0x80090016 | NTE_BAD_KEYSET: TPM keyset missing, for example after the TPM was cleared. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 204 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 204
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Hybrid join events
- Event ID 304: Hybrid join failed (phase and error code)
- Event ID 305: Hybrid join authentication error
- Event ID 307: Hybrid join failure event
- Event ID 201: Hybrid join discover phase error
- Event ID 220: Cannot read the computer object in Active Directory