← cd ~/events
// events/307 · Hybrid join
Event ID 307Hybrid join failure event
Listed by Microsoft, alongside 304 and 305, as one of the events to check for the phase and error code of a hybrid join failure on older Windows 10 builds.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Hybrid join |
What to check
Read it together with 304 and 305 to get the full failure picture.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 307 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 307
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Hybrid join events
- Event ID 304: Hybrid join failed (phase and error code)
- Event ID 305: Hybrid join authentication error
- Event ID 201: Hybrid join discover phase error
- Event ID 204: Hybrid join join-phase error
- Event ID 220: Cannot read the computer object in Active Directory