Skip to content

Primary Refresh Token (sign-in) · Post-join authentication (PRT) phase

Fix PRT error 0xC000006D (STATUS_LOGON_FAILURE)

0xC000006D · STATUS_LOGON_FAILURE Checked against Microsoft Learn

Quick answer

On a joined or hybrid joined device, 0xC000006D in the AzureAdPrt Attempt Status means getting a Primary Refresh Token failed with a logon failure. The authentication service or the WS-Trust endpoint returned HTTP 400. The server error in the same output names the reason. The common one is AADSTS50126 (invalid username or password). On a hybrid device with password hash sync, that usually means a new password hasn't synced yet.

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Run dsregcmd /status as the signed-in user (not elevated). Under SSO State, read Attempt Status, Server Error Code, and Server Error Description.

What 0xC000006D means

The device couldn't get a Primary Refresh Token (PRT) because the Microsoft Entra authentication service or WS-Trust endpoint rejected the sign-in (HTTP 400).

Common causes

  • Microsoft Entra ID returned AADSTS50126: the username or password entered at sign-in was wrong.
  • With password hash sync on a hybrid joined device, the user just changed the password and the new one hasn't synced to Microsoft Entra ID yet.
  • The device can't connect to the authentication service. If an outbound proxy is required, the computer account must be able to discover it and authenticate silently.

How to fix 0xC000006D

  1. Open a Command Prompt as the signed-in user and run dsregcmd /status (on Windows 10 21H1 or later).
  2. Under SSO State, check AzureAdPrt (NO means the PRT wasn't acquired), Attempt Status (0xc000006d), and the Server Error Code / Description.
  3. For AADSTS50126 after a password change, wait for Microsoft Entra password sync to finish, then lock and unlock the device to get a fresh PRT.
  4. For other server errors, read events 1081 and 1088 in the Microsoft Entra operational log (Applications and Services Logs > Microsoft > Windows > AAD). The preceding event 1022 shows the URL being accessed.
  5. If an outbound proxy is in the path, make sure the device's computer account can discover it and authenticate silently.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Primary Refresh Token (sign-in) codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.