Cloud Desktop Re-added to Host Pool but Failing Domain Checks

Question

Cloud Desktop Re-added to Host Pool but Failing Domain Checks

Nicholas Trevizan 25

Hi All,

I have a machine in the cloud that was deleted by someone else (I swear) and I need to get it back. A cloud machine was deleted and has been re-added to the Host Pool, but users are unable to connect due to errors. The Health Check Status shows the following issues:

DomainJoinedCheck Failed This health check verifies that the session host is joined to a domain. If this check fails, it is fatal, and no connections will succeed. To solve this, join the virtual machine to a domain. Learn more
DomainTrustCheck Failed Learn more

The machines are managed by Intune and are currently not connected to a domain (they are all under WORKGROUP). Any suggestions on how to resolve these errors? It is assumed that resolving these issues will allow the VM to function properly. Thank you in advance.

chrischin 915 Reputation points Microsoft Employee

2025-03-28T22:05:54.2733333+00:00

How was the deleted machine recovered?
Mounika Reddy Anumandla 4,300 Reputation points Microsoft External Staff

2025-03-31T05:26:49.13+00:00
Hi Nicholas Trevizan,
Since your cloud machine was deleted and re-added to the Host Pool, but is now failing the DomainJoinedCheck and DomainTrustCheck, the issue is likely related to its domain membership.

Since your machines are not domain-joined and are managed by Intune, it sounds like they were previously Azure AD Joined (Entra ID Joined) rather than traditional Active Directory (AD) domain-joined.

Confirm Azure AD Join Status. Run dsregcmd /status

If it is not Azure AD Joined, Join the VM to Azure AD

Re-Join the Machine to Entra ID

Open Settings > Accounts > Access work or school.

Click Connect and choose Join this device to Azure Active Directory.

Restart the machine.

Verify Intune Enrollment

Go to Settings > Accounts > Access work or school.

Ensure that the device is Connected to Intune.

Re-register with AVD Host Pool: Reset-AVDRegistrationToken -HostPoolName "YourHostPoolName"

Reboot the VM and check if users can connect.

Please tag me for further queries!
chrischin 915 Reputation points Microsoft Employee

2025-03-31T19:50:06.68+00:00
Was this VM recovered from a restore from Azure Backup? Do you see the VM name listed in Microsoft Entra ID\Devices? If so, what is its status there?

To reset an Entra (only) joined VM to address the Domain Check issues:

In the Azure Portal, go to the VM:

go to "Identity," ensure a System assigned identity is enabled

go to "Extensions + applications," ensure the AADLoginForWindows extension is present with a status of "Provisioning succeeded"

Login to the VM as a local admin

In cmd prompt run: dsregcmd /leave

Restart the VM

While the VM is restarting, go back to the Azure Portal. Confirm Microsoft Entra ID\Devices does not show this VM/Device. If it does, it is the old entry, remove it by clicking into the device and click the "Delete" button.

Once the VM completes restarting, log back in as a local admin

In a cmd prompt run: gpedit

Double check auto MDM (Intune) enrollment is on.

Confirm: Computer Configuration\Administrative Templates\Windows Components\MDM\Enable automatic MDM enrollment using default Azure AD credentials = Enabled (Device Credential)

In a cmd prompt run: dsregcmd /join

It can take up to 30 min., but this VM/Device should be rejoined to Entra with Intune

Go back to your AVD host pool and check the session host domain checks.
Nicholas Trevizan 25 Reputation points

2025-04-01T15:04:50.7533333+00:00

Hi @chrischin !

Thanks for trying to help. Once I try the dsregcmd /join, it seems to error out. Please see attached
Mounika Reddy Anumandla 4,300 Reputation points Microsoft External Staff

2025-04-01T15:32:55.4833333+00:00
Hi Nicholas Trevizan,

I could give you some more troubleshooting steps:
Navigate to Entra ID > Devices.

Delete any stale entries matching the name of the recreated VM.

Redeploy the session host after cleanup.
https://stackoverflow.com/questions/77871211/domaintrustcheck-and-domainjoinedcheck-faied-when-creating-vm-for-avd

VMs in WORKGROUP aren’t domain-joined, which is mandatory for AVD connectivity.

Manual Domain Join:

Connect to the VM via RDP using local admin credentials.

Join the VM to the domain via Settings > System > About > Rename this PC.

Reboot and verify domain membership with dsregcmd /status

Azure VMs must be enrolled in Intune at creation via the "Enroll with Intune" checkbox.

If the restored VM wasn’t originally Intune-enrolled. Delete the VM.

Redeploy with Intune enrollment enabled during provisioning.

If device is already Entra ID joined but misconfigured, then Device is blocked by policy from joining Entra ID. Local Group Policy or Intune settings are preventing re-enrollment.

Check Current Device State: AzureADJoined = YES (should be YES for Entra ID Join) DomainJoined = NO (expected, since it's not AD-joined).

If AzureADJoined is NO, Force Rejoin with Entra ID.

Run dsregcmd /leave shutdown /r /t 0 This removes the device from Entra ID and restarts the machine.

After Restart, Rejoin Entra ID Manually: dsregcmd /join Run dsregcmd /status again. If dsregcmd /join fails, policies might be blocking it.

Run This Command to See Applied Policies: gpresult /r

Check If These Policies Are Set to "Enabled" (Blocking Join)

Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration. "Register domain-joined computers as devices" → Should be Enabled

Computer Configuration > Policies > Administrative Templates > System > Logon

"Turn off Microsoft Account Sign-In Assistant" → Should be Not Configured.

Please try this and let me know for further queries!
Nicholas Trevizan 25 Reputation points

2025-04-01T16:31:10.8333333+00:00

Hi @Mounika Reddy Anumandla

After checking, the device does not show up in Entra.

I ran the commands, and it errors out at the join part, see below.
chrischin 915 Reputation points Microsoft Employee

2025-04-01T17:01:08.5633333+00:00
Hi Nicholas,

Can you run 'dsregcmd /status' and paste the results here? The key portion is the 'Diagnostic Data' section where it will show the error message from the previous attempt.

Can you also go to the Windows Task Scheduler and confirm whether or not you see this scheduled task?

Go to Task Scheduler

Navigate to:

Task Scheduler Library\Microsoft\WIndows\Workplace Join

Confirm the existance of the 'Device-Sync' task.

If you see the task there, select it and choose 'Run' in the Actions panel

dsregcmd /join runs this same schedule task.
Nicholas Trevizan 25 Reputation points

2025-04-01T17:15:43.95+00:00

Hi Chris, thanks for getting back to me so quick.

I didn't see anything for Diagnostic while running dsregcmd /status command, here's what came up.

I can confirm that I see Device-Sync in Task Scheduler, but I do not see the Run option

Scratch that, I hit enable and then Run.
chrischin 915 Reputation points Microsoft Employee

2025-04-02T02:34:26.67+00:00

Did the VM show up in Entra after you re-enabled and ran the task?
Mounika Reddy Anumandla 4,300 Reputation points Microsoft External Staff

2025-04-02T08:47:36.99+00:00

Hi Nicholas Trevizan,
I see that AzureADJoined is NO, then as I previously mentioned, you have to Force Rejoin with Entra ID using dsregcmd /join.
I appreciate chrischin helping you further!
Please confirm if you are still facing the issue!
Nicholas Trevizan 25 Reputation points

2025-04-02T12:37:14.8566667+00:00

No, I do not see the VM in Entra, I hit Enable and then Run, restarted the VM, even waited until the next day but doesn't show up in the VM and looks the same.
Nicholas Trevizan 25 Reputation points

2025-04-02T12:38:47.0966667+00:00

Hi Mounika,

I did run the dsregcmd /join , after that I am getting the error "Failed to schedule Join Task. Error: 0x80041326", as shown in my previous screenshot.
chrischin 915 Reputation points Microsoft Employee

2025-04-02T13:07:55.4566667+00:00

Can you re-run the dsregcmd /status and post the results here? Looking for an error message in the diagnostics section to understand what needs to be done.

Just to confirm, you ran through at least the first 8 steps I posted previously? It is odd that the scheduled task was disabled, step #8 (gpedit) should have enabled that task.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Nicholas Trevizan 25 Reputation points

2025-04-02T13:19:15.3866667+00:00

I just noticed task scheduler hasn't run since the 3/24. I just ran it now again. Then I did the dsregcmd /join and it did NOT error out. Waiting to see if it'll join.

UPDATE (12pm): Still has not shown up in Entra, though the command looks like it ran with no errors.
Nicholas Trevizan 25 Reputation points

2025-04-04T13:56:17.6466667+00:00

@chrischin still having an issue, let me know if you have any other ideas, willing to try anything at this point.
chrischin 915 Reputation points Microsoft Employee

2025-04-05T18:53:49.33+00:00
Sorry to hear that it is still not working. I will need more information.

We could try reinstalling the AADLoginForWindows extension. What version of Windows is this VM running?

Did the task scheduler task run successfully? If not, what was the error message?

Can you post the full output of a fresh dsregcmd /status ?

What Azure role do you have when you are performing these actions?

I will need you to check 2 logs in Event Viewer on the VM

I know you said the VM is not domain joined but is there some other software, configuration management, security or otherwise that might be interfering with the join and disabling that task/modifying your registry?

Applications and Service Logs\Microsoft\Windows\

AAD\Operational

DeviceManagement-Enterprise-Diagnostics-Provider - look through Enrollment and the other ones and post anything that looks relevent

Have you checked your Intune enrollment settings? We could also divide and conquor. If we reinstall the AADLoginForWindows extension, we can try to leave out Intune enrollment and see if we can get that to work first. If we can, the problem is probably Intune.

Does it have to be this VM or would it be feasible to stand up a new session host to replace this one?
Nicholas Trevizan 25 Reputation points

2025-04-07T13:31:36.1533333+00:00
Hi Chris, thanks for getting back to me. See below

The OS is Windows 11 Enterprise multi-session, currently the AADLoginForWindows shows as Provisioning Succeeded

Yes, Task Scheduler ran successfully.

It has not changed since I last sent it to you, see below here 4. I have the rights to create/delete VMs so I would think the permissions are okay, haven't seen an error to suggest otherwise.

I don't think so, the other VMs have ZScaler installed but on this machine I have it disabled. Nothing else on it.

I am getting the errors below in the Event Viewer

8. I think the error above is helping figure out the Intune issue, if you think I should reinstall the extension I can try that.

The user has a bunch of specific software installed on this VM and certain configurations, so it would be beneficial to recover this VM.

Thank you for your time, I appreciate your assistance.
chrischin 915 Reputation points Microsoft Employee

2025-04-07T16:04:32.8966667+00:00
Hi Nicholas,

You can try reinstalling the extension:

Navigate to the VM\Extensions + applications

Note the Version, for Win11ms, I would expect 2.2.0.0.

Click the Uninstall button

Reboot the VM

Once the VM is back online after reboot, open Cloud Shell

Run the following in Cloud Shell substituting in your Resource Group name, VM name, and Location

Set-AzVMExtension -ResourceGroupName "<RESOURCE GROUP NAME>" -VMName "<VM NAME>" -Name "AADLoginForWindows" -Location "<LOCATION>" -Publisher "Microsoft.Azure.ActiveDirectory" -Type "AADLoginForWindows" -TypeHandlerVersion "2.2"

Give it about 15 min. and check Entra ID to see if the Device shows up. If not, try to dsregcmd /join again.
Nicholas Trevizan 25 Reputation points

2025-04-07T19:44:16.9533333+00:00

I had to change the resource group! It was in the Hub Subscription the whole time, I had to run the Set-AzContext -Subscription and enter the right one, then I ran your command again and bingo, the error cleared out. Waiting for the user to join, but this looks promising!!
Nikhil Duserla 6,630 Reputation points Microsoft External Staff

2025-04-09T10:09:40.7466667+00:00

Hi @Nicholas Trevizan,

Just checking in to see if the below answer provided by chrischin helped.

If this answers your query, do click Accept Answer and Upvote for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

1 additional answer

Your answer

chrischin 915 Reputation points Microsoft Employee

2025-03-28T22:05:54.2733333+00:00

How was the deleted machine recovered?
Mounika Reddy Anumandla 4,300 Reputation points Microsoft External Staff

2025-03-31T05:26:49.13+00:00

Hi Nicholas Trevizan,
Since your cloud machine was deleted and re-added to the Host Pool, but is now failing the DomainJoinedCheck and DomainTrustCheck, the issue is likely related to its domain membership.

Since your machines are not domain-joined and are managed by Intune, it sounds like they were previously Azure AD Joined (Entra ID Joined) rather than traditional Active Directory (AD) domain-joined.

Confirm Azure AD Join Status. Run dsregcmd /status

If it is not Azure AD Joined, Join the VM to Azure AD

Re-Join the Machine to Entra ID

Open Settings > Accounts > Access work or school.

Click Connect and choose Join this device to Azure Active Directory.

Restart the machine.

Verify Intune Enrollment

Go to Settings > Accounts > Access work or school.

Ensure that the device is Connected to Intune.

Re-register with AVD Host Pool: Reset-AVDRegistrationToken -HostPoolName "YourHostPoolName"

Reboot the VM and check if users can connect.

Please tag me for further queries!
chrischin 915 Reputation points Microsoft Employee

2025-03-31T19:50:06.68+00:00

Was this VM recovered from a restore from Azure Backup? Do you see the VM name listed in Microsoft Entra ID\Devices? If so, what is its status there?

To reset an Entra (only) joined VM to address the Domain Check issues:

In the Azure Portal, go to the VM:

go to "Identity," ensure a System assigned identity is enabled

go to "Extensions + applications," ensure the AADLoginForWindows extension is present with a status of "Provisioning succeeded"

Login to the VM as a local admin

In cmd prompt run: dsregcmd /leave

Restart the VM

While the VM is restarting, go back to the Azure Portal. Confirm Microsoft Entra ID\Devices does not show this VM/Device. If it does, it is the old entry, remove it by clicking into the device and click the "Delete" button.

Once the VM completes restarting, log back in as a local admin

In a cmd prompt run: gpedit

Double check auto MDM (Intune) enrollment is on.

Confirm: Computer Configuration\Administrative Templates\Windows Components\MDM\Enable automatic MDM enrollment using default Azure AD credentials = Enabled (Device Credential)

In a cmd prompt run: dsregcmd /join

It can take up to 30 min., but this VM/Device should be rejoined to Entra with Intune

Go back to your AVD host pool and check the session host domain checks.
Nicholas Trevizan 25 Reputation points

2025-04-01T15:04:50.7533333+00:00

Hi @chrischin !

Thanks for trying to help. Once I try the dsregcmd /join, it seems to error out. Please see attached
Nicholas Trevizan 25 Reputation points

2025-04-01T16:31:10.8333333+00:00

Hi @Mounika Reddy Anumandla

After checking, the device does not show up in Entra.

I ran the commands, and it errors out at the join part, see below.
chrischin 915 Reputation points Microsoft Employee

2025-04-01T17:01:08.5633333+00:00

Hi Nicholas,

Can you run 'dsregcmd /status' and paste the results here? The key portion is the 'Diagnostic Data' section where it will show the error message from the previous attempt.

Can you also go to the Windows Task Scheduler and confirm whether or not you see this scheduled task?

Go to Task Scheduler

Navigate to:

Task Scheduler Library\Microsoft\WIndows\Workplace Join

Confirm the existance of the 'Device-Sync' task.

If you see the task there, select it and choose 'Run' in the Actions panel

dsregcmd /join runs this same schedule task.
Nicholas Trevizan 25 Reputation points

2025-04-01T17:15:43.95+00:00

Hi Chris, thanks for getting back to me so quick.

I didn't see anything for Diagnostic while running dsregcmd /status command, here's what came up.

I can confirm that I see Device-Sync in Task Scheduler, but I do not see the Run option

Scratch that, I hit enable and then Run.
chrischin 915 Reputation points Microsoft Employee

2025-04-02T02:34:26.67+00:00

Did the VM show up in Entra after you re-enabled and ran the task?
Mounika Reddy Anumandla 4,300 Reputation points Microsoft External Staff

2025-04-02T08:47:36.99+00:00

Hi Nicholas Trevizan,
I see that AzureADJoined is NO, then as I previously mentioned, you have to Force Rejoin with Entra ID using dsregcmd /join.
I appreciate chrischin helping you further!
Please confirm if you are still facing the issue!
Nicholas Trevizan 25 Reputation points

2025-04-02T12:37:14.8566667+00:00

No, I do not see the VM in Entra, I hit Enable and then Run, restarted the VM, even waited until the next day but doesn't show up in the VM and looks the same.
Nicholas Trevizan 25 Reputation points

2025-04-02T12:38:47.0966667+00:00

Hi Mounika,

I did run the dsregcmd /join , after that I am getting the error "Failed to schedule Join Task. Error: 0x80041326", as shown in my previous screenshot.
chrischin 915 Reputation points Microsoft Employee

2025-04-02T13:07:55.4566667+00:00

Can you re-run the dsregcmd /status and post the results here? Looking for an error message in the diagnostics section to understand what needs to be done.

Just to confirm, you ran through at least the first 8 steps I posted previously? It is odd that the scheduled task was disabled, step #8 (gpedit) should have enabled that task.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Nicholas Trevizan 25 Reputation points

2025-04-02T13:19:15.3866667+00:00

I just noticed task scheduler hasn't run since the 3/24. I just ran it now again. Then I did the dsregcmd /join and it did NOT error out. Waiting to see if it'll join.

UPDATE (12pm): Still has not shown up in Entra, though the command looks like it ran with no errors.
Nicholas Trevizan 25 Reputation points

2025-04-04T13:56:17.6466667+00:00

@chrischin still having an issue, let me know if you have any other ideas, willing to try anything at this point.
chrischin 915 Reputation points Microsoft Employee

2025-04-05T18:53:49.33+00:00

Sorry to hear that it is still not working. I will need more information.

We could try reinstalling the AADLoginForWindows extension. What version of Windows is this VM running?

Did the task scheduler task run successfully? If not, what was the error message?

Can you post the full output of a fresh dsregcmd /status ?

What Azure role do you have when you are performing these actions?

I will need you to check 2 logs in Event Viewer on the VM

I know you said the VM is not domain joined but is there some other software, configuration management, security or otherwise that might be interfering with the join and disabling that task/modifying your registry?

Applications and Service Logs\Microsoft\Windows\

AAD\Operational

DeviceManagement-Enterprise-Diagnostics-Provider - look through Enrollment and the other ones and post anything that looks relevent

Have you checked your Intune enrollment settings? We could also divide and conquor. If we reinstall the AADLoginForWindows extension, we can try to leave out Intune enrollment and see if we can get that to work first. If we can, the problem is probably Intune.

Does it have to be this VM or would it be feasible to stand up a new session host to replace this one?
Nicholas Trevizan 25 Reputation points

2025-04-07T13:31:36.1533333+00:00

Hi Chris, thanks for getting back to me. See below

The OS is Windows 11 Enterprise multi-session, currently the AADLoginForWindows shows as Provisioning Succeeded

Yes, Task Scheduler ran successfully.

It has not changed since I last sent it to you, see below here 4. I have the rights to create/delete VMs so I would think the permissions are okay, haven't seen an error to suggest otherwise.

I don't think so, the other VMs have ZScaler installed but on this machine I have it disabled. Nothing else on it.

I am getting the errors below in the Event Viewer

8. I think the error above is helping figure out the Intune issue, if you think I should reinstall the extension I can try that.

The user has a bunch of specific software installed on this VM and certain configurations, so it would be beneficial to recover this VM.

Thank you for your time, I appreciate your assistance.
chrischin 915 Reputation points Microsoft Employee

2025-04-07T16:04:32.8966667+00:00

Hi Nicholas,

You can try reinstalling the extension:

Navigate to the VM\Extensions + applications

Note the Version, for Win11ms, I would expect 2.2.0.0.

Click the Uninstall button

Reboot the VM

Once the VM is back online after reboot, open Cloud Shell

Run the following in Cloud Shell substituting in your Resource Group name, VM name, and Location

Set-AzVMExtension -ResourceGroupName "<RESOURCE GROUP NAME>" -VMName "<VM NAME>" -Name "AADLoginForWindows" -Location "<LOCATION>" -Publisher "Microsoft.Azure.ActiveDirectory" -Type "AADLoginForWindows" -TypeHandlerVersion "2.2"

Give it about 15 min. and check Entra ID to see if the Device shows up. If not, try to dsregcmd /join again.
Nicholas Trevizan 25 Reputation points

2025-04-07T19:44:16.9533333+00:00

I had to change the resource group! It was in the Hub Subscription the whole time, I had to run the Set-AzContext -Subscription and enter the right one, then I ran your command again and bingo, the error cleared out. Waiting for the user to join, but this looks promising!!
Nikhil Duserla 6,630 Reputation points Microsoft External Staff

2025-04-09T10:09:40.7466667+00:00

Hi @Nicholas Trevizan,

Just checking in to see if the below answer provided by chrischin helped.

If this answers your query, do click Accept Answer and Upvote for was this answer helpful. And, if you have any further query do let us know.

Answer 1

chrischin 915 Microsoft Employee

Leave out my less than and greater than symbols:

Set-AzVMExtension -ResourceGroupName "RG-UAT-AVD" -VMName "INT-DEVEL-14" -Name "AADLoginForWindows" -Location "eastus" -Publisher "Microsoft.Azure.ActiveDirectory" -Type "AADLoginForWindows" -TypeHandlerVersion "2.2"

Nicholas Trevizan 25 Reputation points

2025-04-07T20:06:47.7566667+00:00

I had to edit my answer above, Chris you're a genius.
chrischin 915 Reputation points Microsoft Employee

2025-04-08T12:12:56.6166667+00:00

Hi Nicholas, did this work and are you good to go?
Nicholas Trevizan 25 Reputation points

2025-04-09T12:47:20.0933333+00:00

Yes, the user is now about to connect to the session from the Windows App. Thank you for your help, I was going in circles trying to figure it out.
chrischin 915 Reputation points Microsoft Employee

2025-04-09T19:13:47.3333333+00:00

Glad I was able to help. Could you please accept as answered? Thanks!
Nikhil Duserla 6,630 Reputation points Microsoft External Staff

2025-04-10T14:44:12.8566667+00:00

Hi @Nicholas Trevizan,

Just checking in to see if the below answer provided by chrischin helped.

If this answers your query, do click Accept Answer and Upvote for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Nicholas Trevizan 25

Hi @Mounika Reddy Anumandla ,

Once I go to the "Access work or school" there is no option to connect the Entra ID. Please see below, thank you.

User's image

Share via

Cloud Desktop Re-added to Host Pool but Failing Domain Checks

1 additional answer

Your answer