Device Compliance & Troubleshooting
Diagnostic Command
Run the following on any Windows device to check its Azure AD and Intune enrollment status:
dsregcmd /statusKey Sections to Review
Device State:
| Field | Healthy Value | Problem If |
|---|---|---|
| AzureAdJoined | YES | NO — device not joined, can’t receive policies |
| DomainJoined | YES (hybrid) or NO (cloud-only) | Unexpected value for your environment |
| WorkplaceJoined | NO (if Azure AD Joined) | YES when AzureAdJoined is NO — registered only |
SSO State:
| Field | Healthy Value | Problem If |
|---|---|---|
| AzureAdPrt | YES | NO — no SSO, auth may hang |
| AzureAdPrtAuthority | https://login.microsoftonline.com/… | Empty — PRT not issued |
Work Account:
| Field | Healthy Value | Problem If |
|---|---|---|
| WorkplaceMdmUrl | https://enrollment.manage.microsoft.com/… | Empty — Intune not enrolled |
| WorkplaceTenantName | Authentica Solutions | Wrong tenant or empty |
Known Errors
Error 2016281112 — Password Complexity Remediation Failed
Cause: Intune compliance policy targeting a device that is only Workplace Registered (not Azure AD Joined). Intune cannot enforce policies on registered-only devices.
Symptoms:
- Login hangs after password entry
- Intermittent — may resolve after restarts
- Other users (Rashmi Choubey, Sharad Velmajala) reported similar issues
Root Cause (confirmed Feb 2026): Device was Workplace Registered but not Azure AD Joined. dsregcmd /status showed:
- AzureAdJoined: NO
- WorkplaceJoined: YES
- AzureAdPrt: NO
- WorkplaceMdmUrl: empty
Fix: Follow the Azure AD Join Guide to properly join the device.
Prevention: Ensure compliance policies are assigned to device groups, not user groups. User-targeted policies will attempt to evaluate against registered devices that can’t actually enforce them.
Compliance Policy Best Practices
- Assign to device groups, not user groups — Prevents policies from targeting unmanaged devices
- Verify enrollment before expecting compliance — A device must be Azure AD Joined and Intune-enrolled before compliance policies apply
- Audit regularly — Check Intune > Devices > Monitor > Noncompliant devices for registration-vs-join mismatches