← cd ~/events
// events/220 · Hybrid join
Event ID 220Cannot read the computer object in Active Directory
Windows could not access its computer object in AD during hybrid join (DSREG_AUTOJOIN_ADCONFIG_READ_FAILED, 0x801c001d). Error 1312 or 1317 points to AD replication problems.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Hybrid join |
What to check
Troubleshoot AD replication. These problems can be transient and the next join attempt may succeed.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x801c001d | DSREG_AUTOJOIN_ADCONFIG_READ_FAILED. |
1312 | ERROR_NO_SUCH_LOGON_SESSION. |
1317 | ERROR_NO_SUCH_USER. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 220 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 220
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Hybrid join events
- Event ID 304: Hybrid join failed (phase and error code)
- Event ID 305: Hybrid join authentication error
- Event ID 307: Hybrid join failure event
- Event ID 201: Hybrid join discover phase error
- Event ID 204: Hybrid join join-phase error