Unable to add Work/School account on Windows 11 Pro - Error -895156188 (0xCAA50024) due to custom registry tweaks

Question

Hello,

I am experiencing an issue on Windows 11 Pro where employees are unable to sign in to a work or school account via Settings > Accounts > Access work or school. The system blocks the account from being added, prevents the company from managing the device, and fails with the following error code:

• Error Code: -895156188 (Hexadecimal: 0xCAA50024)

Through a process of elimination, I have definitively isolated this issue to a series of custom registry edits/optimization configurations I am running on my local machine.

To help save troubleshooting time, I have already checked and verified that the following common policy blocks are NOT the cause (they are either set to default or deleted):

• HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin -> BlockAADWorkplaceJoin is NOT blocking enrollment.
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM -> DisableMDM is NOT set to 1.
• HKCU\Software\Microsoft\Office\16.0\Common\Identity -> WAM and ADAL overrides are at default.
• Existing IDs under HKLM\SOFTWARE\Microsoft\Enrollments have been checked for orphaned GUIDs.

Because error code 0xCAA50024 typically indicates a failure during the automatic device enrollment handshake or a script blocker halting modern authentication/Home Realm Discovery, one of my other registry edits is obviously breaking the device identity underlying mechanism.

Below is the exact list of custom registry tweaks I am applying to this system. Could someone with deep expertise in Entra ID / Intune device enrollment mechanisms review these keys and point out which specific parameter or disabled service is causing the 0xCAA50024 registration block?

OneDrive Policies

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive

DisableFileSyncNGSC = 1 (DWORD)

DisableLibrariesDefaultSaveToOneDrive = 1 (DWORD)

DisableTutorial = 1 (DWORD)

DisableAutoConfig = 1 (DWORD)

DisableKFMIntegration = 1 (DWORD)

DisablePersonalSync = 1 (DWORD)

DisableBackup = 1 (DWORD)

 

Image File Execution Options (Recovery Bypass)

Path: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemReset.exe

Debugger = C:\Durp\AWSaysNo.exe (String)

 

Toast, App Notifications, and Hardware Settings

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer

DisableNotificationCenter = 1 (DWORD)

DisableSecurityAndMaintenanceNotifications = 1 (DWORD)

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\System

EnableMmxNotifications = 0 (DWORD)

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications

NoToastApplicationNotification = 1 (DWORD)

NoTileNotification = 1 (DWORD)

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Notifications

NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK = 0 (DWORD)

NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS_ABOVE_LOCK = 0 (DWORD)

NOC_GLOBAL_SETTING_ALLOW_TOASTS_FROM_APPS = 0 (DWORD)

Path: HKLM\SYSTEM\CurrentControlSet\Services\USB

DisableSelectiveSuspend = 1 (DWORD)

 

Content Delivery & Cloud Content Suggestions

Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager

SubscribedContent-338388Enabled = 0 (DWORD)

SubscribedContent-353694Enabled = 0 (DWORD)

Path: HKLM\SOFTWARE\Policies\Microsoft\Dsh

AllowNewsAndInterests = 0 (DWORD)

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent

DisableConsumerFeatures = 1 (DWORD)

DisableSoftLanding = 1 (DWORD)

 

Explorer User Interface Propagation

Path: HKU<User-SID>\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced (Applies to all local profiles matching S-1-5-21-*)

StartShownOnFirstBoot = 0 (DWORD)

ShowTaskViewButton = 0 (DWORD)

Path: HKU.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

StartShownOnFirstBoot = 0 (DWORD)

ShowTaskViewButton = 0 (DWORD)