Hybrid Join Error 0x801c03f2: Device Object Not Found Fix

A domain-joined Windows device won’t finish Microsoft Entra hybrid join. An elevated dsregcmd /status shows AzureAdJoined : NO, Error Phase : join and Client ErrorCode : 0x801c03f2. Microsoft names the code DSREG_E_DIRECTORY_FAILURE and describes it as “Received an error response from DRS with ErrorCode: “DirectoryError”.” The device got as far as the device registration service (DRS), and DRS refused the join.

Several different causes share this client code. The Server Message line under it tells you which one you have, so read that line before you change anything.

Quick Fix checklist

Run dsregcmd /status from an elevated command prompt and copy the whole Diagnostic Data block: Registration Type, Error Phase, Client ErrorCode, Server ErrorCode, Server Message and Request Id.
If the server message is “The device object by the given id … isn’t found”, the computer object hasn’t reached Microsoft Entra ID yet. Wait for a Microsoft Entra Connect sync cycle (30 minutes by default) and let the device retry.
If it still fails after a sync, check whether the computer’s OU or domain is in sync scope. Run Troubleshoot Object Synchronization in the Microsoft Entra Connect wizard against the computer’s distinguished name.
If the server message is “The public key user certificate is not found on the device object”, check the userCertificate attribute on the computer object in Active Directory. If it’s empty, follow the re-registration steps in The fix.
If the server message contains AADSTS90002: Tenant ... not found, the service connection point (SCP) has the wrong tenant ID. Fix the SCP.
If a device that used to be hybrid joined now shows Pending after someone moved it between OUs, run dsregcmd /leave elevated and restart it.
If 0x801C03F2 shows up during Windows Hello for Business PIN setup instead of in dsregcmd, you have a different problem: a duplicate proxyAddresses value. See the Windows Hello section.
Verify with dsregcmd /status (AzureAdJoined : YES) and the Registered column in the Microsoft Entra admin center.

What 0x801c03f2 means in Microsoft’s words

Microsoft’s hybrid join troubleshooting guide lists DSREG_E_DIRECTORY_FAILURE (0x801c03f2/-2145647630) under the HTTP errors returned from DRS in the join phase. The resolution column says: “Refer to the server error code for possible reasons and resolutions.”

Microsoft’s sample output for this code looks like this:

     Previous Registration : 2019-01-31 09:16:43.000 UTC
         Registration Type : sync
               Error Phase : join
          Client ErrorCode : 0x801c03f2
          Server ErrorCode : DirectoryError
            Server Message : The device object by the given id (aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb) is not found.
              Https Status : 400
                Request Id : 6bff0bd9-820b-484b-ab20-2a4f7b76c58e

In the same sample, every diagnostic test above it passes: AD Connectivity, AD Configuration, DRS Discovery, DRS Connectivity and Token acquisition. The error phase is join, the last of the four phases Microsoft lists (precheck, discover, auth, join). Line of sight to a domain controller, the SCP read and access to https://enterpriseregistration.windows.net all worked well enough for DRS to send back a response.

These are the server messages Microsoft documents for this situation:

Server message	Microsoft’s reason	Where to fix it
”The device object by the given ID isn’t found."	"This error is expected for sync-join. The device object hasn’t synced from AD to Microsoft Entra ID”	Microsoft Entra Connect sync and sync scope
”The public key user certificate is not found on the device object with id `<DeviceID>`”	The device object is missing in Microsoft Entra ID, or the `Usercertificate` attribute doesn’t have the device certificate	`userCertificate` on the computer object, then sync
”AADSTS90002: Tenant `UUID` not found."	"The tenant ID in the service connection point object is incorrect.”	The SCP `keywords` attribute

The first and third rows come from the sync-join server error table in the hybrid join troubleshooting guide. The second comes from Microsoft’s co-management auto-enrollment troubleshooting article, which covers 0x801c03f2 in a managed domain.

Why the obvious diagnosis can be wrong

The usual reaction is “it’s a sync delay, give it an hour.” On a freshly domain-joined computer that’s often right, and Microsoft says so: the error is expected until Microsoft Entra Connect syncs the device. These are the cases where waiting doesn’t help.

The computer is out of sync scope

Microsoft’s hybrid join prerequisites say that if your computers are in specific OUs, you must configure those OUs to sync in Microsoft Entra Connect. A computer created in an OU that isn’t selected never reaches Microsoft Entra ID, so every hourly retry returns the same “isn’t found” message. Microsoft’s Autopilot hybrid join requirements make the same point for the OU or container intended for Windows Autopilot devices, where the Intune Connector for Active Directory creates their computer objects: if Microsoft Entra Connect uses domain and OU filtering, that OU must be in sync scope.

Someone renamed the OU

Microsoft’s filtering guidance says that when you explicitly select an OU, Microsoft Entra Connect stores its distinguished name in the inclusion list. If you later rename the OU, the distinguished name changes and Microsoft Entra Connect no longer treats that OU as in scope. Microsoft notes it won’t cause an immediate issue, but the next full import re-evaluates scope and deletes the out-of-scope objects from Microsoft Entra ID. New computers in that OU then fail with “isn’t found”, and existing ones can disappear. After any OU rename, rerun the wizard and reselect the OU.

The device object exists but has no certificate

In a managed environment, the Automatic Device Join task creates a self-signed certificate and writes it to the userCertificate attribute of the computer object over LDAP. Microsoft Entra Connect syncs that certificate along with the object GUID and computer SID, and DRS uses them to create the device object. Microsoft’s sync attribute reference says a Windows 10 domain-joined computer is identified by having userCertificate populated. If the attribute is empty, or someone deleted the certificate from Active Directory (which also removes it from Microsoft Entra ID), DRS can’t authenticate the device. Waiting for another sync won’t help, because there’s no certificate to sync.

The device was registered before and is now Pending

Microsoft’s pending devices article describes this sequence: you move a hybrid joined computer to an OU outside sync scope, Microsoft Entra Connect treats that as a deletion and deletes the device in Microsoft Entra ID, you move it back, and sync creates a new Pending device object. The device “fails to complete the device registration process because it was registered previously.” Moving it back into scope isn’t enough. The device has to leave and register again.

The SCP points at the wrong tenant

If the server message is AADSTS90002, the device read an SCP that names a tenant that doesn’t exist or has no active subscriptions. Sync isn’t involved. Fix the azureADId value in the SCP.

Evidence to collect

dsregcmd /status in SYSTEM context

Run it from an elevated command prompt. Microsoft’s dsregcmd documentation notes that the join runs in SYSTEM context and that an elevated run shows the diagnostics in that context. The Diagnostic Data section appears only when the device is domain-joined and can’t hybrid join.

dsregcmd /status

Record these fields:

Field	What it tells you
`DomainJoined`	Must be `YES`.
`AzureAdJoined`	`NO` until the join completes.
`Registration Type`	`sync` in Microsoft’s example for this code.
`Error Phase`	`join` for this code.
`Server ErrorCode`	`DirectoryError`.
`Server Message`	Picks the cause from the table above.
`Request Id`	Keep it for a support case.

On Windows 10 versions earlier than 1803, Microsoft says to use the User Device Registration event log instead and look for event ID 204 for join phase failures. Microsoft’s co-management article shows the certificate variant of the message logged in Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin.

The computer object and its userCertificate

From a machine with the Active Directory module (RSAT), read the attribute. Get-ADComputer returns a default set of properties, so ask for userCertificate with -Properties. This is a read-only query; I haven’t run it against a production directory. Replace PC-0042 with the device name.

Get-ADComputer -Identity 'PC-0042' -Properties userCertificate, DistinguishedName |
    Select-Object Name, DistinguishedName, @{ n = 'CertCount'; e = { $_.userCertificate.Count } }

A CertCount of 0 matches the “public key user certificate is not found” case. The DistinguishedName tells you which OU to check against your sync scope. With more than one domain controller, Microsoft says to make sure the attribute is replicated to all of them.

Sync scope for that object

On the Microsoft Entra Connect server (version 1.1.749.0 or later), open an elevated PowerShell session, start the wizard, and go to Additional Tasks > Troubleshoot > Launch > Troubleshoot Object Synchronization. Give it the object’s distinguished name and the AD connector name. Among other checks, the task reports whether the object is filtered by domain or by OU filtering.

The device in Microsoft Entra ID

In the Microsoft Entra admin center, go to Entra ID > Devices > All devices and find the device. Pending in the Registered column means the object synced but hybrid join hasn’t completed. No object at all fits the “isn’t found” case.

To list every pending hybrid device, Microsoft’s pending devices article gives this Microsoft Graph PowerShell query, run after Connect-MgGraph:

Get-MgDevice -All -Filter "TrustType eq 'ServerAd'" | Where-Object{(-not $_.AlternativeSecurityIds)} | select-object -Property AccountEnabled, Id, DeviceId, DisplayName, OperatingSystem, OperatingSystemVersion, TrustType | export-csv pendingdevicelist-summary.csv -NoTypeInformation

The fix

Match the fix to the server message.

”isn’t found” on a new device: let sync run

Microsoft’s resolution is to wait for Microsoft Entra Connect Sync to finish, and “the next join attempt after sync completion will resolve the issue.” The default sync interval is 30 minutes. To avoid waiting, start a delta cycle on the Microsoft Entra Connect server:

Start-ADSyncSyncCycle -PolicyType Delta

The Automatic Device Join task retries every hour and on user sign-in, so the device retries on its own after the sync.

”isn’t found” that persists: fix sync scope

If the troubleshooting task reports OU or domain filtering, add the OU or domain through the wizard’s domain and OU filtering page. For an OU that was renamed, reselect it in the wizard. Microsoft says the installation wizard automates the filtering tasks, and its scheduler guidance says a filtering change that alters which objects are included needs a full import on each AD connector. Then let a sync cycle run.

Check the default device attributes too. Microsoft’s prerequisites say not to exclude the default device attributes from your Microsoft Entra Connect Sync configuration. If a custom sync rule removed them, restore them.

”public key user certificate is not found”: re-register the device

Microsoft’s steps for a managed domain, on the client:

From an elevated command prompt, run dsregcmd /leave.
Open certlm.msc and make sure the computer certificate issued by MS-Organization-Access is deleted.
Restart the device to trigger a fresh registration.
Confirm the new certificate public key is on the computer object’s userCertificate in Active Directory, and that it has replicated to all domain controllers.
Run a delta sync on the Microsoft Entra Connect server.
After the sync, trigger registration by restarting the device, running dsregcmd /debug, or running the Automatic-Device-Join scheduled task under Workplace Join.

Pending after an OU move: leave and rejoin

Run dsregcmd /leave at an elevated command prompt and restart. The device starts registration again through the scheduled task at Task Scheduler Library > Microsoft > Windows > Workplace Join > Automatic-Device-Join.

AADSTS90002: correct the SCP

Set the SCP keywords so azureADId is your Microsoft Entra tenant ID. The 0x801c001d SCP article has the SCP path, the read script and the client-side SCP registry check.

The same code during Windows Hello PIN setup

0x801C03F2 also appears in Microsoft’s Windows Hello for Business PIN creation error table, where it means “Windows Hello key registration failed” with ERROR_BAD_DIRECTORY_REQUEST. Microsoft’s explanation there is that another object with the same proxyAddresses value already exists. The fix is to resolve the duplicate attribute, and if there’s no sync conflict, to check that the mail address in Microsoft Entra ID and the primary SMTP address in the proxy addresses match.

Tell the two apart by where you see the code. Hybrid join failures show it in dsregcmd /status with Error Phase : join on a device that isn’t joined yet. The Windows Hello case shows up when a user sets up a PIN. The SCP, userCertificate and OU checks above don’t apply to it.

Retry and verify

Sign out and back in, restart, or wait for the hourly Automatic Device Join retry.
Run dsregcmd /status elevated. Confirm AzureAdJoined : YES and DomainJoined : YES.
In the Microsoft Entra admin center, the Registered column should show a date and time instead of Pending.

What not to waste time on

Proxy and TLS inspection exclusions. The device already got a DirectoryError response from DRS, so it reached the service.
Rebuilding the SCP when the message is “isn’t found”. The SCP read worked; only AADSTS90002 points at the SCP.
Intune enrollment settings and the MDM auto-enrollment GPO. Microsoft says GPO autoenrollment relies on the Microsoft Entra registration for the PC, which is the step that’s failing.
Forcing sync over and over for a computer in an OU that’s out of scope. Fix the scope first.
Moving a computer out of sync scope and back as a quick fix. Microsoft documents that this deletes the device in Microsoft Entra ID and leaves it Pending.

Prevention checklist

Keep a list of the OUs that hold hybrid join computers, including the Intune Connector for Active Directory OU for Autopilot, and confirm each one is in Microsoft Entra Connect sync scope.
After renaming any OU in sync scope, rerun the Microsoft Entra Connect wizard and reselect it.
Don’t move hybrid joined computers into OUs outside sync scope unless you plan to remove them from Microsoft Entra ID.
Never clear userCertificate on computer objects as a cleanup step.
Don’t exclude the default device attributes in custom sync rules.
Watch the pending device count with the Get-MgDevice query above. A growing number points to scope or registration problems.
Put the full elevated dsregcmd /status Diagnostic Data block, including Server Message, in your escalation template.

Hybrid join error 0x801c001d covers the discover-phase failure where the device can’t read the SCP.
Co-management MDM enrollment error 0xcaa9001f covers the enrollment step that depends on a working hybrid join.
Auto MDM Enroll Failed 0x8018002b covers GPO-based Intune enrollment after hybrid join.
Autopilot pre-provisioning error 0x801C03F3 covers a neighboring code where the Microsoft Entra device object was deleted.

Sources

Troubleshoot Microsoft Entra hybrid joined devices: 0x801c03f2 definition, sample output, sync-join server errors, event ID 204.
Troubleshoot devices by using the dsregcmd command: SYSTEM context and the diagnostic tests in the sample.
Troubleshoot auto-enrolling existing Configuration Manager devices in Intune: the “public key user certificate is not found” message and re-registration steps.
How Microsoft Entra device registration works: userCertificate and the managed hybrid join flow.
Pending devices in Microsoft Entra ID: the OU move scenario, dsregcmd /leave fix and pending device query.
Attributes synchronized by Microsoft Entra Connect: device attributes and the userCertificate identification rule.
Configure Microsoft Entra hybrid join: OU sync and default device attribute prerequisites.
Enrollment for Microsoft Entra hybrid joined devices (Windows Autopilot): OU sync scope requirement for Autopilot devices.
Microsoft Entra Connect Sync: Configure filtering: OU rename behavior.
Microsoft Entra Connect: Troubleshoot object synchronization: the Troubleshoot Object Synchronization task.
Microsoft Entra Connect Sync: Scheduler: 30-minute default and Start-ADSyncSyncCycle.
Verify Microsoft Entra hybrid join state: Registered and Pending states.
Windows Hello errors during PIN creation: the Windows Hello meaning of 0x801C03F2.
Get-ADComputer: the -Properties parameter.
Enroll a Windows device automatically using Group Policy: autoenrollment relies on Microsoft Entra registration.

Hybrid Join Error 0x801c03f2: Device Object Not Found Fix

Quick answer

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes