Skip to content

Microsoft Entra hybrid join · Discover phase

Fix hybrid join error 0x801C0021 (DRS discovery failed)

0x801C0021 · DSREG_AUTOJOIN_DISC_FAILED Checked against Microsoft Learn

Quick answer

0x801C0021 is a generic Microsoft Entra hybrid join failure in the discover phase. The device read its service connection point but couldn't fetch discovery metadata from the device registration service. The real reason is in the sub-error code next to it, usually a network code such as 0x80072EE2. Check that https://enterpriseregistration.windows.net is reachable in the system context, including through your proxy.

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Look at the DRS Discovery Test line in dsregcmd /status. It shows two codes, for example FAIL [0x801c0021/0x80072ee2], and the second one is what you troubleshoot.

What 0x801C0021 means

Generic discovery failure: the device couldn't get the discovery metadata from the device registration service (DRS).

Common causes

  • The device can't reach https://enterpriseregistration.windows.net in the system (computer) context.
  • An outbound proxy requires authentication that the device's computer account can't discover or complete silently.
  • A proxy changes the response: Microsoft lists decoding failures (0x80072F8F) and HTML auth pages returned as HTTP 200 (0x8007000D) as related sub-errors.
  • DRS returned an HTTP error, for example 0x801C003A (tenant not found) or 0x801C0025 (server busy, HTTP 503).

How to fix 0x801C0021

  1. On Windows 10 1803 or later, run dsregcmd /status on the affected device and read the Diagnostic Data section (it appears only on a domain-joined device that hasn't completed hybrid join).
  2. Find the DRS Discovery Test result and note the sub-error after the slash. On earlier Windows 10 versions, open Event Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration and look for event ID 201.
  3. For a network sub-error (0x80072EE2, 0x80072EFD, 0x80072EE7), test access to https://enterpriseregistration.windows.net from the system context, not as the signed-in user.
  4. If you use an outbound proxy, make sure the computer account can discover it and authenticate to it silently.
  5. For 0x801C003A, check that the SCP has the correct tenant ID. For 0x801C0025, wait and retry, because Microsoft says later attempts usually succeed once DRS is back.
  6. Retry the join and check dsregcmd /status again.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Microsoft Entra hybrid join codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.