Windows workstation between on-premises directory services, cloud identity, and a secure password vault during Hybrid Entra Join and LAPS troubleshooting

How to Troubleshoot Hybrid Entra Join and Windows LAPS

by

Hybrid Entra Join troubleshooting becomes confusing when two symptoms appear at the same time: a new domain-joined Windows device remains Pending in Microsoft Entra ID, while its local administrator password changes unexpectedly. The symptoms look related, but they normally belong to two separate control planes—device registration and Windows LAPS.

Quick answer: do not delete the Entra device object or reset the computer first. Capture dsregcmd state, applied computer policies and the Windows LAPS operational log. In the incident behind this guide, event 10023 exposed Policy source: LegacyLaps. The password was stored in the legacy Active Directory attribute even though it was not visible on the modern LAPS tab.

Table of contents

The failure pattern

The real case started with a newly installed Windows device. It was joined to the on-premises domain and moved into an organizational unit where Hybrid Entra Join policies applied. Two things then happened:

  • The device appeared in Microsoft Entra ID with a Pending registration state.
  • The password for the managed local administrator account changed, but the expected password was not visible in either the Entra portal or the modern LAPS view in Active Directory Users and Computers.

Hybrid Join does not rotate a local administrator password. A separate Windows LAPS or legacy Microsoft LAPS policy must have performed that action. Treat the problem as two parallel investigations until the evidence proves otherwise.

Safety boundary before troubleshooting

  • Do not delete the Entra device object merely because it says Pending.
  • Do not remove the computer from the domain or clear the TPM as a first step.
  • Do not repeatedly force password rotation until you know where LAPS is backing up the password.
  • Run password-retrieval commands only from a secured administrative workstation and do not paste the returned password into tickets or chat.
  • Collect read-only evidence before changing GPO links, registry values or device registration.

1. Capture the Hybrid Entra Join state

Run the following from an elevated Command Prompt on the affected device:

dsregcmd /status

For a healthy Microsoft Entra hybrid joined device, the important combination is:

AzureAdJoined : YES
DomainJoined  : YES

A domain device that has not completed registration commonly shows:

AzureAdJoined : NO
DomainJoined  : YES

Save the Device State, Device Details, Tenant Details and Diagnostic Data sections, including Error Phase and Client ErrorCode. A Pending portal object only tells you that synchronization created the cloud object; it does not prove that the Windows client completed registration.

Capture the applied computer policies

Create a temporary folder and export a Group Policy report:

New-Item -ItemType Directory -Path C:\Temp -Force
gpresult /r /scope computer
gpresult /h C:\Temp\gp-computer.html

Open the HTML report and inspect every applied Computer GPO. Do not assume that removing one visible LAPS link removed every possible policy source. Another GPO, local policy or existing registry-backed configuration may still be active.

2. Read the Windows LAPS operational log

If you can administer the device remotely, you do not need to sign in interactively with your normal user account. From an administrative workstation, run:

$Computer = 'PC-TEST01'

Get-WinEvent -ComputerName $Computer -FilterHashtable @{
    LogName   = 'Microsoft-Windows-LAPS/Operational'
    StartTime = (Get-Date).Date
} | Select-Object TimeCreated, Id, Message | Format-List

If remote Event Log access is blocked, use Event Viewer and choose Connect to Another Computer, then browse to:

Applications and Services Logs
  Microsoft
    Windows
      LAPS
        Operational

Events that matter in this investigation

Event What it tells you
10003 LAPS policy processing started.
10004 Policy processing completed successfully.
10018 The password was successfully written to Active Directory.
10020 The managed local account password was updated.
10023 The effective policy configuration, including policy source, backup directory and account settings.
10052 / 10054 Why policy processing ran, such as background scheduling or a Group Policy notification.
10055 The domain controller used by LAPS.

In the source incident, event 10023 contained the decisive clue:

Policy source: LegacyLaps
Backup directory: Active Directory
Local administrator account name: Admin
Password age in days: 30
Password complexity: 4
Password length: 14

That output proved that Windows LAPS was running in legacy Microsoft LAPS emulation mode. It also explained why looking only at modern msLAPS-* data produced no answer.

3. Identify the active LAPS policy source

Legacy Microsoft LAPS policy settings use this registry location:

HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd

Query it remotely:

reg query "\\PC-TEST01\HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd"

Or use PowerShell remoting:

Invoke-Command -ComputerName 'PC-TEST01' {
    Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd'
}

Compare values such as AdmPwdEnabled, AdminAccountName, PasswordComplexity, PasswordLength and PasswordAgeDays with event 10023 and the Group Policy report.

Do not delete the registry key simply because it exists. First find the configuration source and decide whether the device should remain on legacy emulation temporarily or move to a supported Windows LAPS policy. A new Windows LAPS policy takes precedence over a legacy policy, so migrations should be designed rather than improvised during an outage.

4. Retrieve the password from the correct directory attribute

From a management system with the Windows LAPS PowerShell module and sufficient permissions, try:

Get-LapsADPassword -Identity 'PC-TEST01' -AsPlainText

Security note: -AsPlainText exposes the secret in the console. Use it only when access recovery requires the actual password, protect the session and clear any transcript or shared screen.

The current Get-LapsADPassword cmdlet can retrieve a password stored in the legacy ms-Mcs-AdmPwd attribute. A legacy result identifies its source as LegacyLapsCleartextPassword.

Read legacy attributes directly when necessary

Get-ADComputer 'PC-TEST01' -Properties 'ms-Mcs-AdmPwd','ms-Mcs-AdmPwdExpirationTime' |
Select-Object Name,
  @{Name='Password';Expression={$_.'ms-Mcs-AdmPwd'}},
  @{Name='Expiration';Expression={$_.'ms-Mcs-AdmPwdExpirationTime'}}

Legacy Microsoft LAPS uses ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime. Modern Windows LAPS uses msLAPS-* attributes. The modern Windows LAPS property page in Active Directory Users and Computers does not display the legacy attributes. Therefore, “the password is not on the LAPS tab” is not evidence that no backup exists.

If event 10018 confirms a successful AD backup but the command returns Access Denied, investigate delegated read permissions. If the attribute is empty, preserve the LAPS events and determine whether the backup failed before attempting another rotation.

5. Troubleshoot the pending Hybrid Entra registration

Once local administrator access is understood, return to device registration. Check the automatic join task:

schtasks /Query /TN "\Microsoft\Windows\Workplace Join\Automatic-Device-Join" /V /FO LIST

Review the registration log:

Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' -MaxEvents 50 |
Select-Object TimeCreated, Id, LevelDisplayName, Message |
Format-List

Then validate DNS and outbound HTTPS reachability:

Resolve-DnsName enterpriseregistration.windows.net
Test-NetConnection enterpriseregistration.windows.net -Port 443
Test-NetConnection login.microsoftonline.com -Port 443

The actual join runs in the computer context, so a successful interactive-user web test does not automatically prove that SYSTEM can pass through the proxy or firewall. Also verify:

  • The Service Connection Point contains the correct tenant information.
  • The computer can reach a domain controller.
  • The computer OU is inside the Microsoft Entra Connect synchronization scope.
  • The device object has completed a synchronization cycle before the next registration attempt.
  • The dsregcmd Error Phase and error code match the suspected failure.

When to consider dsregcmd /leave

Microsoft documents dsregcmd /leave followed by a restart for a specific stale-registration scenario: a previously registered computer was moved out of sync scope, deleted in Entra, moved back and then recreated as Pending. It is not the first command for every new Pending device.

dsregcmd /leave
shutdown /r /t 0

Use this only after confirming the scenario, recording the existing state and scheduling a change window. The scheduled Automatic-Device-Join task should initiate registration again after restart.

Hybrid Entra Join and LAPS decision table

Evidence Interpretation Next action
Policy source: LegacyLaps Windows LAPS is honoring legacy policy. Read the legacy AD attribute and find the policy source.
10018 and 10020 are present AD backup and local password update succeeded. Check permissions and query ms-Mcs-AdmPwd.
Password exists but modern LAPS tab is empty The password may be stored in legacy attributes. Use Get-LapsADPassword or query the legacy attribute.
DomainJoined: YES, AzureAdJoined: NO Domain join is complete; Entra registration is not. Follow the Diagnostic Data error phase and registration log.
Portal shows Pending The synchronized device object exists but registration has not completed. Check SCP, client connectivity, sync scope and join diagnostics.

Operational lessons from the incident

  1. Separate simultaneous symptoms. Hybrid registration and password rotation happened together, but different mechanisms controlled them.
  2. Trust effective-state evidence. Event 10023 and gpresult are more useful than assumptions about which GPO should be active.
  3. Know the legacy boundary. Modern tools can read legacy LAPS data, but the modern ADUC property page does not display it.
  4. Diagnose before resetting. Deleting device objects, leaving Entra or rotating another password can destroy the evidence needed to understand the first failure.
  5. Plan the LAPS migration. Do not leave legacy emulation as an accidental long-term state after access has been restored.

Frequently asked questions

Can Hybrid Entra Join change the local administrator password?

No. Hybrid Join registers the device with Microsoft Entra ID. Windows LAPS or legacy Microsoft LAPS rotates the local administrator password.

Why is the device Pending in Microsoft Entra ID?

The on-premises computer object has synchronized to Entra, but the Windows device has not completed registration. Use dsregcmd /status and the User Device Registration log to find the failed phase.

Why is the LAPS password missing from the modern ADUC tab?

If event 10023 reports LegacyLaps, the password may be stored in ms-Mcs-AdmPwd. The modern Windows LAPS property page does not display legacy attributes.

Can Get-LapsADPassword read a legacy LAPS password?

Yes. Microsoft documents support for retrieving the legacy ms-Mcs-AdmPwd attribute with Get-LapsADPassword.

Should I delete a Pending device and start again?

Not as the first response. Capture join diagnostics and confirm the cause. Re-registration is appropriate only after you understand whether the object is new, stale or outside synchronization scope.

Official references

Conclusion

The fastest route through this failure is not a reset—it is evidence. First identify which LAPS policy actually ran and where it stored the password. Then troubleshoot the Hybrid Entra registration as a separate workflow. That sequence restores access without losing the clues required to prevent the same incident on the next device.