Skip to content
October 9, 2026 • Senior (5+ years) Error Reference

Hybrid Join Error 0x801c001d: Fix the SCP Read Failure

By Last updated

Hybrid join error 0x801c001d (DSREG_AUTOJOIN_ADCONFIG_READ_FAILED) means Windows could not read the SCP from AD. Check dsregcmd, event 220 and the SCP keywords.

Quick answer

0x801c001d is DSREG_AUTOJOIN_ADCONFIG_READ_FAILED. During Microsoft Entra hybrid join, Windows could not read the service connection point (SCP) from Active Directory to find your tenant. Check the AD Configuration Test in an elevated dsregcmd /status, the SCP keywords in your forest, any client-side SCP registry values, and event ID 220 for AD replication errors.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Step-by-step guide

Hybrid Join Error 0x801c001d: Fix the SCP Read Failure

A domain-joined Windows device never shows up as Microsoft Entra hybrid joined. dsregcmd /status reports AzureAdJoined : NO, and the User Device Registration log has error 0x801c001d. Microsoft names this code DSREG_AUTOJOIN_ADCONFIG_READ_FAILED. The device failed before it ever talked to Microsoft Entra ID: it could not read the service connection point (SCP) in Active Directory that tells it which tenant to join.

Treat it as an on-premises Active Directory problem first. Proxy rules and Intune settings come later, if at all.

Quick Fix checklist

  1. Decide whether this device is supposed to hybrid join at all. If your organization doesn’t use hybrid join, Microsoft says events 307 and 304 with 0x801c001d are expected and can be ignored.
  2. Run dsregcmd /status from an elevated command prompt so the diagnostics run in SYSTEM context. Read AD Connectivity Test, AD Configuration Test, Error Phase and Client ErrorCode.
  3. If AD Connectivity Test fails, fix line of sight to a domain controller (office network or VPN) before you touch the SCP.
  4. If AD Configuration Test fails, read the SCP object’s keywords attribute in the configuration naming context of the computer’s forest. It must contain azureADId: and azureADName: values.
  5. On the device, check HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD for TenantId and TenantName. A client-side SCP from a targeted-rollout GPO takes precedence over the directory SCP.
  6. In a multi-forest environment, confirm the SCP exists in every forest that contains domain-joined computers.
  7. In the User Device Registration log, look for event ID 220. Errors 1312 or 1317 there point to Active Directory replication.
  8. After the fix, sign in again or wait for the hourly Automatic Device Join retry, then rerun dsregcmd /status and check the device in the Microsoft Entra admin center.

What 0x801c001d means in Microsoft’s words

Microsoft’s hybrid join troubleshooting guide lists DSREG_AUTOJOIN_ADCONFIG_READ_FAILED (0x801c001d/-2145648611) in two places, with two different causes.

In the discover phase table, the reason is:

Unable to read the service connection point (SCP) object and get the Microsoft Entra tenant information.

In the join phase “Other errors” table, the same code carries a different reason:

Event ID 220 is present in User Device Registration event logs. Windows can’t access the computer object in Active Directory. A Windows error code might be included in the event. Error codes ERROR_NO_SUCH_LOGON_SESSION (1312) and ERROR_NO_SUCH_USER (1317) are related to replication issues in on-premises Active Directory.

Microsoft’s resolution for the second case is to troubleshoot Active Directory replication, and it notes that these replication issues might be transient.

So one hex code covers two separate failures. The SCP read failure is a configuration problem. The event 220 failure is a directory health problem. The fix for one does nothing for the other, which is why you read the evidence before changing anything.

Why the obvious diagnosis can be wrong

The first instinct is “the SCP is missing, rerun Microsoft Entra Connect.” Sometimes that’s right. These are the cases where it isn’t.

The device isn’t meant to hybrid join

KB4480781 describes events 307 and 304 with 0x801c001d appearing during Windows deployment. Microsoft’s cause is that the infrastructure isn’t prepared for hybrid join, and its resolution says that in a non-hybrid join environment these events are expected and can be ignored. If you don’t run hybrid join, don’t build an SCP just to silence a log.

The device reads a client-side SCP

Microsoft’s targeted deployment guidance says the SCP might be configured locally in the device registry, and if the device finds a value there it uses that configuration instead of querying the directory. A pilot GPO that writes TenantId and TenantName under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD can outlive the pilot. Check the device before you edit the forest.

The SCP is in the wrong forest

The SCP lives in the configuration naming context, and Microsoft notes there’s only one configuration naming context per forest. In a multi-forest environment the SCP must exist in every forest that contains domain-joined computers. A correct SCP in the user forest doesn’t help a computer that lives in a resource forest.

The device can’t reach a domain controller

Microsoft’s precheck phase requires line of sight to a domain controller, on the internal network or over VPN. The dsregcmd documentation says an AD Connectivity Test error likely produces a pre-check phase failure, while an AD Configuration Test error likely produces the discover phase failure with 0x801c001d. Read both lines.

Event 220 points to replication

If event 220 is present with 1312 or 1317, Windows couldn’t access its own computer object. Editing the SCP won’t change that.

Microsoft endpoint connectivity gives different codes

If the device read the SCP and then failed to reach https://enterpriseregistration.windows.net, you’d see a different discover-phase code, such as DSREG_AUTOJOIN_DISC_WAIT_TIMEOUT (0x801c001f) or DSREG_AUTOJOIN_DISC_FAILED (0x801c0021). A wrong tenant ID in a readable SCP returns DSREG_DISCOVERY_TENANT_NOT_FOUND (0x801c003a). If the code is 0x801c001d, proxy and TLS inspection exclusions aren’t the first thing to check.

Evidence to collect

dsregcmd /status in SYSTEM context

Microsoft notes that the join runs in SYSTEM context, and running dsregcmd /status from an elevated command prompt runs the diagnostics in SYSTEM context, which is closest to the real join. The Diagnostic Data section appears only when the device is domain-joined and unable to hybrid join.

dsregcmd /status

Fields to read:

FieldWhat it tells you
DomainJoinedMust be YES. If it’s NO, the device can’t do hybrid join.
AzureAdJoinedNO means the join hasn’t finished.
AD Connectivity TestConnectivity to a domain controller. Failure points to the pre-check phase.
AD Configuration TestReads and verifies the SCP in the on-premises forest. Failure points to the discover phase and 0x801c001d.
Error Phasepre-check, discover, auth or join.
Client ErrorCodeThe HRESULT, here 0x801c001d.

User Device Registration events

Open Event Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration. The events Microsoft ties to this code:

  • 307: “Automatic registration failed. Failed to lookup the registration service information from Active Directory.” with 0x801c001d (KB4480781).
  • 304: “Automatic registration failed at join phase.” with 0x801c001d (KB4480781).
  • 220: Windows can’t access the computer object in Active Directory. Look for 1312 or 1317 in the event.

To pull them with PowerShell (read-only; I haven’t run it against a production device):

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-User Device Registration/Admin'
    Id      = 220, 304, 307
} -MaxEvents 50 | Format-List TimeCreated, Id, Message

Client-side SCP registry values

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD"

If this key returns TenantId and TenantName, the device is using a client-side SCP. Confirm the tenant ID matches your Microsoft Entra tenant and that TenantName is a verified domain (or your onmicrosoft.com domain in a managed environment). If the key doesn’t exist, the device reads the SCP from Active Directory.

The SCP object in Active Directory

The SCP for automatic registration of domain-joined devices is at:

CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,[Your Configuration Naming Context]

Get the configuration naming context with Get-ADRootDSE, then read the keywords with Microsoft’s script. Replace the DC= components with the root of the forest that holds the failing computer object.

(Get-ADRootDSE).configurationNamingContext

$scp = New-Object System.DirectoryServices.DirectoryEntry;

$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=fabrikam,DC=com";

$scp.Keywords;

Healthy output has two values, in this shape:

azureADName:microsoft.com
azureADId:a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1

azureADName must be a verified domain, and it decides whether the device follows the federated or managed registration flow.

The fix

SCP missing or empty

Configure the SCP. The usual path is Microsoft Entra Connect: in the hybrid join configuration, the SCP configuration page lets you set the SCP for each forest. That requires enterprise administrator credentials for each on-premises forest. If you configure it by hand, use the object path and keywords format above, with azureADid: set to your tenant ID and azureADName: set to a verified domain.

SCP correct, device has a stale client-side SCP

Find the GPO that writes TenantId and TenantName under SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD (Group Policy Preferences registry items, per Microsoft’s targeted deployment guide). Correct the values or retire the pilot GPO so devices fall back to the directory SCP. Leave AD FS servers out of that cleanup. Microsoft’s note says that if AD FS servers don’t have the client-side SCP, the source for device identities is considered on-premises, and AD FS starts deleting device objects from the on-premises directory after the MaximumInactiveDays period.

Multi-forest gap

Create the SCP in each forest that holds domain-joined computers you want to hybrid join.

Event 220 with 1312 or 1317

Treat it as Active Directory replication. Microsoft’s replication guidance reads the status from repadmin /showrepl (part of RSAT). From an elevated PowerShell session:

repadmin /showrepl * /csv | convertfrom-csv | out-gridview

Fix the replication errors you find. Microsoft says these replication issues might be transient and go away after a while, so a single event 220 on one device is a weaker signal than repeated events across a site.

No line of sight to a domain controller

Get the device onto the corporate network or a VPN that reaches a domain controller, then let the join retry.

Retry and verify

You don’t need to reimage. Microsoft documents that the Automatic Device Join task triggers on domain join and with user sign-in, and retries every hour. After the fix:

  1. Sign out and back in, or wait for the hourly retry.
  2. Run dsregcmd /status elevated. Confirm AzureAdJoined : YES and DomainJoined : YES.
  3. In the Microsoft Entra admin center, go to Entra ID > Devices > All devices and find the device. A date and time in the Registered column means hybrid join completed. Pending means it hasn’t finished. In a managed environment the device also needs a Microsoft Entra Connect sync cycle before it can authenticate, so allow for that.

A new code after the fix usually means the device got further. A device that now fails with 0x801c03f2 and the server message “The device object by the given id … isn’t found” during sync-join is waiting on Microsoft Entra Connect; Microsoft calls that expected until sync completes.

What not to waste time on

  • Repackaging or reassigning Intune apps. The device hasn’t reached Microsoft Entra ID yet.
  • Proxy and TLS inspection exclusions for this specific code. Those matter for 0x801c001f, 0x801c0021 and 0x8007000d, which happen after the SCP read.
  • Rebuilding the SCP when event 220 shows replication errors.
  • Silencing 0x801c001d on devices that were never meant to hybrid join.

Prevention checklist

  • Document whether each forest and OU is in hybrid join scope, and which SCP method it uses (directory SCP or client-side GPO).
  • When a targeted rollout ends, remove the client-side SCP GPO from workstation OUs and confirm devices read the directory SCP. Handle AD FS servers separately.
  • After any Microsoft Entra Connect reconfiguration or forest change, re-read the SCP keywords in every forest.
  • Monitor Active Directory replication health; event 220 with 1312 or 1317 on clients is a downstream symptom.
  • Make sure remote devices get line of sight to a domain controller (VPN) before you expect them to hybrid join.
  • Keep an elevated dsregcmd /status capture in your escalation template. The Diagnostic Data block shows the failing phase and test in one place.

Sources

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related error codes

Related Articles

senior 13 min read

Hybrid Join Error 0x801c03f2: Device Object Not Found Fix

Hybrid join error 0x801c03f2 (DSREG_E_DIRECTORY_FAILURE): the server message separates a sync delay, an out-of-scope OU, a missing userCertificate or bad SCP.

mid 11 min read

Error 80090016: Trusted Platform Module Has Malfunctioned

Error 80090016 (NTE_BAD_KEYSET) means the device keys Entra ID registered are gone from the TPM. Don't clear the TPM; re-register the device by join type.

senior 13 min read

0x800706FD DenyLocalLogOn: Hybrid Pre-Provisioning Fails

0x800706FD DenyLocalLogOn in Autopilot hybrid pre-provisioning means a UserRights conflict needed a domain controller. Find the policy, then fix the tech flow.

#Microsoft Entra hybrid join #0x801c001d #dsregcmd #Service connection point #Active Directory