Entra Id on new win 11 pro unable to establish local admin

Question

Hi,

On a new workstation we joined device to Entra ID via global admin acct. Entra configured to set all users as local admin. All attempts to grant user admin rights on this device have failed. Device deleted in Entra but device remains registered (verified thru cmd line). Any help is appreciated, thanks!

Answer 1

Use the Microsoft Entra Joined Device Local Administrator role and the PRT behavior to fix this.

1. Verify the device state
   • In the Microsoft Entra admin center, go to Entra ID > Devices > All devices and confirm whether the device is Enabled or has been Deleted/Disabled.
   • If it was deleted and recreated, the local device can still show as registered until it is re-joined or re-registered.
2. If the device was deleted or disabled in Entra ID
   • Because the local state still shows as registered, re-register or recover the join on the device:
     • Open Command Prompt as administrator on the Windows 11 device.
     • For a Microsoft Entra joined device, run:

              dsregcmd /forcerecovery
       

       Then select Sign in and complete sign-in, sign out, and sign back in.
     • If the device is Microsoft Entra hybrid joined instead, run:

              dsregcmd.exe /debug /leave
       

       Then sign out and sign back in with domain credentials to trigger re-registration.
3. Ensure the user is actually in scope for local admin
   • In the Microsoft Entra admin center, go to Entra ID > Devices > Device settings.
   • Under Manage Additional local administrators on all Microsoft Entra joined devices, ensure the intended users/groups are added.
   • This setting assigns the Microsoft Entra Joined Device Local Administrator role tenant-wide to those users.
4. Force the device to pick up the updated local admin role (PRT refresh)
   • The local admin privilege is delivered via the Primary Refresh Token (PRT), not by directly listing the user in the local Administrators group.
   • On the affected device, sign in as the user, then:
     1. Open Command Prompt as that user and run:

                dsregcmd /status
        

        Confirm a PRT is present in the SSO State section.
     2. Schedule a PRT refresh:

                dsregcmd /refreshprt
        

        Wait 1–2 minutes.
     3. Sign out of Windows completely, then sign back in (do not just lock/unlock).
     4. Verify local admin by running:

                whoami /groups
        

        Confirm that BUILTIN\Administrators appears in the group list.
   • Alternatively, wait up to 4 hours for automatic PRT renewal, then have the user sign out and back in.
5. If the device is still problematic
   • Unjoin and rejoin:
     • Ensure there is an offline local admin account.
     • Go to Settings > Accounts > Access work or school, select the Entra account, choose Disconnect, and follow prompts.
     • Reboot, then join the device again to Entra ID and sign in with the user who should be local admin.

These steps ensure the device object and join state in Entra ID match the local state, and that the user receives the Microsoft Entra Joined Device Local Administrator role via a fresh PRT.

---

References:

• How to manage the local administrators group on Microsoft Entra joined devices
• No local administrator group privileges on Microsoft Entra joined device
• Microsoft Entra device management FAQ
• Error AADSTS700003 - Device object was not found in the tenant '<TenantName>' directory
• Troubleshooting Windows devices in Microsoft Entra ID