Error 0x80070088 While Enrolling in Microsoft Endpoint Manager

Question

Error 0x80070088 While Enrolling in Microsoft Endpoint Manager

HWhite 1

I am attempting to set up GPO enrollment (User credential) for Hybrid Azure AD joined windows devices, but am running into 2 main problems. I can get the devices to enroll no problem off of a fresh windows installation on a test PC. However, when I attempt to enroll devices that have been Azure AD registered previously (I removed the registration before attempting to enroll) I am unable to get the device to enroll and get the following error:

Error 0x80070088 "Auto MDM Enroll: Device Credential (0x1), Failed (The system tried to delete the JOIN of a drive that is not joined" while attempting to enroll a laptop into Microsoft Endpoint Manager.

My understanding of this error is that the device is not able to register because the laptop is not Hybrid Azure AD registered fully. The main issue with this is that I can't get the devices that have previously been Azure AD registered to Hybrid AD join through Azure AD Connect on our DC. When I try to do so, the PC is will show in azure devices as pending.

Running dsregcmd /status gives me error 0x801c03f3 which seems to be suggest that the registration is looking for a device object but cannot find it. The device ID that it is trying to find matches the device ID that is shown as pending in Azure. This is where I am currently stuck trying to figure out how to resolve the error.

The system I am currently trying to enroll is a Microsoft Surface Laptop 3 running OS version 21h1.

Any help is appreciated.

Lu Dai-MSFT 28,501 Reputation points

2022-12-15T03:13:20.03+00:00

@HWhite Before GPO enrollment, it is needed to complete Hybrid Azure AD joined process. It is suggested to refer to the following article to troubleshoot:
https://learn.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current#step-3-find-the-phase-in-which-join-failed-and-the-errorcode

Such Hybrid Azure AD joined issue is more related to Azure AD scope. I will add Azure AD tag. Let's wait for the related support engineer involved in this issue to share helpful information.

Thanks for your understanding.

1 answer

Your answer

Lu Dai-MSFT 28,501 Reputation points

2022-12-15T03:13:20.03+00:00

@HWhite Before GPO enrollment, it is needed to complete Hybrid Azure AD joined process. It is suggested to refer to the following article to troubleshoot:
https://learn.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current#step-3-find-the-phase-in-which-join-failed-and-the-errorcode

Such Hybrid Azure AD joined issue is more related to Azure AD scope. I will add Azure AD tag. Let's wait for the related support engineer involved in this issue to share helpful information.

Thanks for your understanding.

Answer 1

Akshay-MSFT 17,956 Microsoft Employee Moderator

Hello @HWhite

Kindly try the following:

Validate if the device is part of the OU you are trying to sync. If the computer objects belong to specific organizational units (OUs), configure the OUs to sync in Azure AD Connect. To learn more about how to sync computer objects by using Azure AD Connect, see Organizational unit–based filtering
Once added kindly run Start-ADSyncSyncCycle -PolicyType Delta in admin PowerShell.
Apart from this try dsregcmd /join and see if you are able to do AAD join (this would help in validating if AAD endpoints are reachable).

Thanks,
Akshay Kaushik

Please "Accept the answer", "Upvote" and rate your experience if the suggestion works as per your business need. This will help us and others in the community as well.

HWhite 1 Reputation point

2023-01-03T18:43:47.787+00:00

Sorry for the late response. Haven't had time to do much given the Holidays. That said, the device is in a OU that is targeted by Azure AD connect and I've made sure to run the Powershell command.

I probably should have mentioned this in the original question, but when I run dsregcmd /join it asks me to run it in an elevated command prompt. Running the command in an admin cmd prompt it gives me the error 0x80070002. Adding Debug to the join command only adds DeleteFileW returned 0x80070002. Running dsregcmd /status /debug tells me the file that it is trying to find and delete, navigating to the folder in file explorer where the file should exist shows that it is not there. I think this specific error is related to the fact that it is running from an elevated command prompt since running dsregcmd /status from the normal user account gives me a separate error "0x801c03f3" as I mentioned in the original question.
Sullivan Cavalcante 0 Reputation points

2023-09-15T14:44:06.99+00:00

Hello @hwhite

I have the same problem. Same error codes. Can you share how you managed to solve it?

Share via

Error 0x80070088 While Enrolling in Microsoft Endpoint Manager

1 answer

Your answer