Skip to content

Microsoft Entra hybrid join · Discover phase

Fix hybrid join error 0x801C003D (realm discovery failed)

0x801C003D · DSREG_AUTOJOIN_USERREALM_DISCOVERY_FAILED Checked against Microsoft Learn

Quick answer

0x801C003D is a discover-phase hybrid join failure during user realm discovery. On Windows 10 1809 and later the device calls https://login.microsoftonline.com in the system context to find out whether your verified domain is managed or federated. When that fails you get this generic code. Find the sub-error, then fix system-context access to login.microsoftonline.com (proxy authentication included).

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Can the device reach https://login.microsoftonline.com in the system context? Realm discovery runs as the computer, not the user.

What 0x801C003D means

Generic realm discovery failure: the device couldn't determine whether the domain is managed or federated from the security token service.

Common causes

  • The device can't reach https://login.microsoftonline.com in the system context.
  • An outbound proxy that the system context can't discover or silently authenticate to.
  • The response from the realm endpoint was blocked or changed on the way.

How to fix 0x801C003D

  1. On Windows 10 1803 or later, run dsregcmd /status on the affected device and read the Diagnostic Data section (it appears only on a domain-joined device that hasn't completed hybrid join).
  2. Note the sub-error code next to 0x801c003d. On earlier builds, check the User Device Registration event log (event ID 201).
  3. Allow https://login.microsoftonline.com for the device's system context through the firewall and proxy.
  4. If a proxy is required, make sure the computer account can discover it and authenticate silently.
  5. Retry the join and confirm discovery passes in dsregcmd /status.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Microsoft Entra hybrid join codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.