CMTrace Open
WORKFLOW 02 · FIELD INVESTIGATION

Device identity and join.

Read join state, registration events, and token evidence together when device identity drifts.

INVESTIGATION START

Start with the affected user and device state.

Begin at the moment access, enrollment, or single sign-on stopped behaving as expected. Capture the current join snapshot, then compare it with registration events and token state for the same user session instead of treating every identity symptom as a failed join.

  1. EVIDENCE 01

    DSRegCmd

    Provides the current AzureAdJoined, DomainJoined, tenant, device, and diagnostic state reported by Windows.

  2. EVIDENCE 02

    User Device Registration

    Records registration attempts, scheduled-task activity, discovery, authentication, and the reason codes behind a join transition.

  3. EVIDENCE 03

    PRT and join state

    Shows whether device registration and Primary Refresh Token readiness agree for the active user session.

WHAT CMTRACE OPEN CONNECTS

Separate device join from sign-in readiness.

CMTrace Open lines up the DSRegCmd snapshot with User Device Registration events and PRT evidence, making it clear when the device object is joined but the user token is missing, stale, or blocked by a later authentication step.

Open stable downloads