Event ID 304Hybrid join failed (phase and error code)

What to check

Note the phase (precheck, discover, authentication or join) and error code, then use the matching section of the hybrid join troubleshooting guide. On newer builds run dsregcmd /status instead.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 304 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 304
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Hybrid join events

• Event ID 305: Hybrid join authentication error
• Event ID 307: Hybrid join failure event
• Event ID 201: Hybrid join discover phase error
• Event ID 204: Hybrid join join-phase error
• Event ID 220: Cannot read the computer object in Active Directory

Search all 123 event IDs →