dsregcmd /status Explainer
Paste dsregcmd /status output and get every field explained — join state, PRT, device certificate, Windows Hello prerequisites — with the failures called out.
✓ runs 100% in your browser — no data leaves this page
Run dsregcmd /status in a command prompt as the signed-in user — the PRT and
Windows Hello sections are only filled in for the user running it. Run it elevated as well if you need
the SYSTEM-context join diagnostics and KeySignTest. Nothing is uploaded: the text is parsed in your browser.
Frequently asked
Does the output leave my browser?
No — it's parsed client-side in WebAssembly. The output does contain your tenant ID, device ID and the signed-in user's UPN, which is exactly why this tool doesn't upload it.
Should I run dsregcmd elevated or not?
Both, for different reasons. As the signed-in user (not elevated) you get the real User State and SSO State — PRT, Windows Hello, WAM. Elevated, the diagnostics run in the SYSTEM context like the actual join does, and KeySignTest can run. Paste either; the tool tells you which sections are missing.
AzureAdPrt says NO — what now?
On a joined device that means SSO is broken for this user: apps prompt for credentials and device-based Conditional Access can't see the device. Check that dsregcmd ran as that user rather than elevated, then sign out and back in. If it stays NO, the PRT diagnostics fields (Attempt Status, Server Error Description) name the actual failure.
What's the difference between joined and registered?
AzureAdJoined: YES is a device join — the device itself has an identity in Entra ID. WorkplaceJoined: YES under User State is Microsoft Entra registered — a personal device where one user added a work account. Registered devices have no Device Details or Tenant Details section at all.