On-premise AD devices to Azure AD - Hybrid join - Dual state issue

Bindesh Patel 1 Reputation point
2020-05-22T14:45:38.26+00:00

We are planning the enrolment all of our on-prem Windows 10 devices to Azure AD via Azure AD connect to make them all Hybrid Azure AD joined then will we enrol them into intune.

At the moment I am currently in the testing phase with a handful of devices. However, I am experiencing a dual state for some of the devices. From reading the Microsoft documentation if the user has AD registered the device before the Hybrid join then a dual state will occur. If devices are on 1803 or above when the same user logs into the device the dual state/AD registered part will be removed and Azure AD will be left with the Hybrid joined one.

This is not the case for me I am still seeing a dual state for the device even after signing back into the machine it has not removed the dual state. My devices are on 1903, therefore, the AD registered dual state should be removed and I should be left with only the Hybrid joint device in azure. I have also read somewhere if the device is managed by intune it will not remove the dual state, I can confirm the device is not managed by intune either at the moment.

Can anyone help? , ideally, I don't want to be asking users to remove the AD registered manually on each device. Is there an option for me to remove all AD registered devices opposite to doing it manually? before I hybrid join the devices.

Thanks in advance

Bindesh

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,462 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jai Verma 461 Reputation points
    2020-05-22T18:08:27.713+00:00

    If you have SCCM, you are lucky and can deploy script which can first check if the device is in dual state and run dsregcmd /leave, followed by restart of the device, which will add the device back to AAD.

    Did you deploy original image 1903 or upgrade from older version?

  2. SathishKumar Patchaiappan 16 Reputation points
    2020-05-23T23:32:26.487+00:00

    Hi @Bindesh Patel ,

    The best way to do the removal in bulk is by running ps commands.

    You can use the below command

    $dt = [datetime]’2018/12/12’

    Get-MsolDevice -All -LogonTimeBefore $dt | select-object -Property DeviceId | foreach {$.DeviceID} | foreach {$.Guid} | Remove-MsolDevice -Force

    To delete with a time older than specific date

    Reference : https://learn.microsoft.com/en-us/powershell/module/msonline/remove-msoldevice?view=azureadps-1.0