dsregcmd /status shows Error Phase : discover with Client ErrorCode : 0x801c0021, typically
alongside DRS Discovery Test : FAIL. The device got as far as trying to discover the Device
Registration Service — reading the discovery metadata endpoint and making a user realm request —
and that step failed. Registration stops there; nothing downstream is even attempted.
0x801C0021
Device registration failed in the discover phase
What it means
Common causes
Outbound access to
enterpriseregistration.windows.netorlogin.microsoftonline.comis blocked, intercepted, or requires proxy authentication the SYSTEM context cannot supply.TLS inspection on the path rewrites the certificate chain and the device rejects the response.
The user realm request cannot be completed — commonly a federation endpoint that is unreachable or misconfigured.
For hybrid join, the Service Connection Point is wrong, which produces a discover-phase failure of its own (0x801c001d).
How to fix it
Run
dsregcmd /statusfrom an elevated prompt so the diagnostics run in the SYSTEM context, the same context the real registration uses, and read the AD/DRS test results together rather than in isolation.Verify the device can reach
https://enterpriseregistration.windows.netandhttps://login.microsoftonline.comwithout proxy authentication and without TLS interception.Exclude the device registration endpoints from TLS inspection — this is the single most common fix in enterprises that see this only on managed networks.
Check the second code in brackets on the DRS Discovery Test line (for example
[0x801c0021/0x801c000c]) — it identifies the specific sub-failure.