how to fix azure hybrid device deleted automatically by Device registration service.

Vivek Gupta 20

I am trying to find out the reason for hybrid join device deleted by Device registration service automatically after join the machine few days back, since in azure there is no more information in audit logs, hence looking help on this.

Dietzius Thomas 0 Reputation points

2024-05-08T12:59:19.7766667+00:00

I'm having the same issue. Can I ask you if you have Conditional Access policies in place?
Shafiq 0 Reputation points

2024-09-05T23:32:11.49+00:00

Hi, did you get it solved? I also have the exact same problem
Robert A. Lewis 21 Reputation points

2024-11-21T17:24:46.43+00:00

I also have at least one device that deletes itself almost every day. The user does not have the ability or knowledge to manually "disconnect this account" or run any commands in CMD.

According the Audit Logs, on one particular day, the log looks like this:

3:44:28 PM Add device

12:14:12 PM Add device

12:14:11 PM Delete device

12:13:53 PM Add Device

12:13:40 PM Delete Device

So it is deleting then adding a few seconds later, then it also added it later in the day even though it had not been deleted...two "Add device" in a row.

1 answer

Domooney-MSFT 2,596 Reputation points Microsoft Employee

2024-03-07T11:00:18.4133333+00:00

Hi Vivek Gupta,

Thank you for posting your query on Microsoft Q&A!

If the device was removed by "Device registration service" then it seems the user disconnected from the Entra ID domain from the device itself, possibly by clicking "Disconnect this account" in their Windows settings, or running the command "Dsregcmd /leave" in CMD.

If you connect to the device and run "dsregcmd /status" it will show if it is still joined from the device side, if not you can join it again here by running "dsregcmd /join"

Do let me know if you have any further queries, I would be happy to help.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Vivek Gupta 20 Reputation points

2024-03-07T11:18:29.9033333+00:00

Hi Domooney,

Thanks for your answer, in my environment user does not have local admin rights as well as he is not aware such stuff to execute, problem here when user start having issue accessing app from cloud, it is not opening due to conditional access policy not met due to device not compliant, also no one in team executing those command for deletion, is there any conflict between Intune /Azure AD device registration causing such issue, moreover we have multiple user similar issue.

after joined hybrid after some time it is deleted. kindly elaborate more on this.

Thanks

Vivek Gupta

Domooney-MSFT 2,596 Reputation points Microsoft Employee

2024-03-07T14:17:39.24+00:00

Hi Vivek,

Can you access the device and run "dsregcmd /status" and check how it looks there? Does the user have an active inTune license? Is the device still in the same OU in the on-prem AD which is sync'd to Azure?

Normally if an admin deletes the device there is an audit log in Entra ID for this, if the device is taken out of scope from AD Sync, then you will see the sync service account delete the device. Removal from device registration service usually occurs from action on the device itself.

Kind Regards,

Donal

Dave Guest 0 Reputation points

2024-05-22T08:22:28.0833333+00:00

We have an identical problem. We have an Entra ID where devices are being deleted after around 2 weeks. The devices believe they are still joined although the DeviceAuthStatus is showing FAILED (so we knew to look for the device in Entra ID). There is a CA policy in place but it is set to Report Only but this also means that the Security Defaults are disabled.

Intune is set not to remove stale devices but there are no policies or configuration linked to any devices and the devices were never enrolled.

We have now rebuilt all the devices to get them back into Entra (128 laptops to be rebuilt) but would like to understand the process that deleted them in the first place.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

how to fix azure hybrid device deleted automatically by Device registration service.

1 answer

Your answer