Hello everyone. Today, we’re going to investigate the error message ‘DsrDeviceAutoJoin failed 0x80070005‘ when trying to turn a domain-joined device into Hybrid Azure AD Joined.
Scenario: Azure AD Hybrid Device Join
In this article, we’ll focus on the error message, but if you are looking for the requirements and steps to implement Azure AD Hybrid Device Join, please check this Official Microsoft implementation guide.
Checking device registration status
Prior to the Hybrid Join implementation, once you run the command dsregcmd /status on a windows 10 or 11 domain-joined machines, you may face the device state as below:
+———————————————————————-+
| Device State |
+———————————————————————-+
AzureAdJoined : NO
EnterpriseJoined : NO
DomainJoined : YES
DomainName : CORP
Device Name : WS10-Hybrid.corp.contoso.comIn case you have DomainJoined is YES, and AzureAdJoined set to NO, means the device is currently joined to the OnPrem Active Directory only.
For more information about all parameters in the output, please check this Microsoft Official document.
ISSUE: You have implemented all steps to have your domain-joined devices turn into Azure AD Hybrid join, and the devices still don’t show AzureAdJoined as YES.
You face the error message: DsrDeviceAutoJoin failed 0x80070005.
Investigating the issue
There are some events and tools that can be used to investigate device join process in the client. We are going to use below ones:
– Utility dsregcmd
– Event viewer log Microsoft-Windows-User Device Registration/Admin
– Event viewer log Microsoft-Windows-User Device Registration/Debug
Dsregcmd diagnostic data
Running dsregcmd /status using a command prompt in one affected machine, you can see in the Diagnostic Data that DsrDeviceAutoJoin is failing:
C:\Windows\system32>dsregcmd /debug /join
DsrCLI: logging initialized.
DsrCLI: logging initialized.
DsrCmdJoinHelper::Join: ClientRequestId: 4a6320a5-d718-48cd-86bb-XXXXXXXXXXXX
DsrCmdAccountMgr::IsDomainControllerAvailable: DsGetDcName success { domain:corp.contoso.com forest:corp.contoso.com domainController:\DC1.corp.contoso.com isDcAvailable:true }
PreJoinChecks Complete.
preCheckResult: Join
deviceKeysHealthy: undefined
isJoined: undefined
isDcAvailable: YES
isSystem: YES
keyProvider: undefined
keyContainer: undefined
dsrInstance: undefined
elapsedSeconds: 0
resultCode: 0x0
Automatic device join pre-check tasks completed.
TenantInfo::Discover: Join Info { TenantType = Managed; AutoJoinEnabled = 1; TenandID = fd39635d-9671-415e-bc9a-ab239464f3b4; TenantName = ulyneves.onmicrosoft.com }
DsrDeviceAutoJoin failed 0x80070005.
DsrCmdJoinHelper::Join: DsrCmdDeviceEnroller::AutoEnrollSync failed with error code 0x80070005.
DSREGCMD_END_STATUS
AzureAdJoined : NO
EnterpriseJoined : NO
Now, checking the Event viewer log Microsoft-Windows-User Device Registration/Admin, we can find a few errors related to permissions to update the signing certificate for automatic registration:
Unable to verify or update the signing certificate for automatic registration. Exit code: Access is denied..
Checking the event viewer log Microsoft-Windows-User Device Registration/Debug filtering by event ID 502, we see the DeviceRegistrationApi failing to save the signing cert into the device’s attributes in the OnPrem AD.
DirectoryServerUtil::SaveAutoSigningCert: LdapServer::AddAttributeValue failed with error code: 0x80070005.
DirectoryServerUtil::SaveAutoSigningCert – hr: 0x80070005
RegistrationController::GenerateAutoSigningCert: DirectoryServerUtil::SaveAutoSigningCert failed with error code: 0x80070005.
DeviceRegistrationApi::BeginAutoJoin: Unable to verify or update the signing cert for DEVICE_AUTO join.
DsrDeviceAutoJoin failed 0x80070005.
Back to event viewer log Microsoft-Windows-User Device Registration/Admin, filtering by event IDs 304 and 304, we can see the Azure DRS service discover phase has failed:
REASON: Based on the logs above, the automatic join task is failing to update the device’s userCertificate attribute on the computer object. This is explained on phase C in this Microsoft official article, that says:
For the managed environment, the task creates an initial authentication credential in the form of a self-signed certificate. The task writes the certificate to the userCertificate attribute on the computer object in Active Directory using LDAP.
FIX: The Automatic Device Join task run under the SYSTEM context and therefore, use the device identity to update its own attributes. Basically, you need to guarantee that the computer account has proper permissions to add/update its attributes.
To reproduce the issue, I removed the permission ‘Write personal information’ from the user ‘SELF’ on the computer account. Without this permission, the device gets access denied when trying to save the self-signed certificate into the userCertificate attribute.
Once I return the permission to write into its attributes, after the Autojoin task runs, we can see the self-signed certificate populated into the userCertificate attribute:
Phase D: The computer can’t authenticate to Azure DRS until a device object representing the computer that includes the certificate on the userCertificate attribute is created in Azure AD. Azure AD Connect detects an attribute change. On the next synchronization cycle, Azure AD Connect sends the userCertificate, object GUID, and computer SID to Azure DRS. Azure DRS uses the attribute information to create a device object in Azure AD.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/devices/device-registration-how-it-works#hybrid-azure-ad-joined-in-managed-environments
After the device is properly SYNCED, and we sign in to the machine, the Automatic Device Join task triggers again, and now we see a successful join:
Event Viewer Log: Microsoft-Windows-User Device Registration/Admin
Event ID: 306
And we confirm with the output of command dsregcmd /status, that the affected device has both Azure DomainJoined and AzureAdJoined set to YES.
+———————————————————————-+
| Device State |
+———————————————————————-+
AzureAdJoined : YES
EnterpriseJoined : NO
DomainJoined : YES
DomainName : CORP
Device Name : WS10-Hybrid.corp.contoso.comSummary
In this article, we covered how to investigate the error message ‘DsrDeviceAutoJoin failed 0x80070005‘ when trying to turn a domain-joined device into Hybrid Azure AD Joined.
I hope you have enjoyed reading this article, and it helps you manage your Hybrid devices in Azure AD.
Enjoyed the article? Like and share. 🙂
Note: I do not represent the organization I work for, all the opinions expressed here, are my own. This post is provided AS IS with no warranties or guarantees and confers no rights.
In case you have any suggestions or feedback, please leave a comment.
[ ]’s
Ulysses Neves
