dsregcmd
SafeEntra join status
dsregcmd /status
Shows Entra join state and PRT health — the go-to when device SSO to company resources breaks.
Examples
dsregcmd /status | findstr /i azureadjoinedJust the join flagsdsregcmd /status | findstr /i "AzureAdJoined DomainJoined AzureAdPrt"Join state plus PRT presence, update time and expirydsregcmd /leaveLeave Entra ID (run as administrator)
Syntax
dsregcmd /status
Key points
- AzureAdJoined: YES together with DomainJoined: YES means hybrid joined.
- AzureAdPrt: YES means a PRT is present. Check AzureAdPrtUpdateTime and AzureAdPrtExpiryTime to see whether it is current. NO means SSO will not work. The PRT is per user, so run it as the signed-in user, not elevated.
- The Diagnostic Data section shows the error code and the stage that failed.
When it does not work
- If hybrid join never completes, check device sync in Entra Connect and the service connection point (SCP) in AD.
Before you run it
Read only.
Related commands
- Get-MgAuditLogSignInSign-in logs
- nltestDomain/DC diagnostics
The same reference, with no signal at all
Every command on this site, held on your device. The app adds 632 more: 1,510 commands and 120 fix flows, searchable with no connection. Free to install, no ads (some content is a one-time purchase).
Get it free on the App Store