Hybrid Azure Devices and Other BYOD stuck on 'pending'

[Warwick_Tech]

So we've had a calamity.

 

I checked our Azure AD devices tab to find we had over 7000 devices (lucky us)

 

While the majority were guest, home and laptops from lockdown we had several hundred doamin devices registered multiple times.

 

So, along comes Mr. powershell and converts them all to hybrid devices (fine) and purports to delete devices over 180 days old

 

Get-MsolDevice -all | Where-Object {$_.ApproximateLastLogonTimestamp -gt $(Get-Date).AddDays(-180)} | Foreach-Object {Remove-MsolDevice -DeviceId $_.DeviceId -Force}

 

Now, this failed dramatically as it not only deleted seemingly random devices, but all the hybrid PC's too.

 

After a delta sync with the AAD tool I was able to bring them back, but now they're all stuck on 'pending'

 

After a lengthy call with Ms support the only way to resolve this is to visit each machine individually and enter

 

dsregcmd /leave

 

At an elevated CMD prompt, then wait for the delta sync, then wait for a user to login.

 

You know where this is going, I don't want to manually do 800+ devices so has anyone any thoughts?

 

I was thinking a trapdoor script to run the command at startup, but then it will remove all the ones that are not stuck on 'pending'

 

Also, why on a Friday?

 

Going to have nightmares about little Jimmys parents phoning up asking why the 'school laptop' no longer works....

[free780]

Yep startup script or scheduled task.

 

Each devices needs to leave AAD and then join again.

 

Unless they are hybrid with SCCM and a VPN where you can push out a script to correct the issue. There is a attribute in powershell to filter the personal devices which might help next time.

[chaplic]

Ouch, that's harsh. My instinctive thought would have been that pending machines would just reconnect on next login, but if you have to disconnect and rejoin client side that's painful.

 

I assume you are doing this for a security control - but consider at this moment another part of security (availability) is compromised, so I would be considering removing what requirement you have for hybrid AAD join in the meantime with perhaps compensating controls (e.g. monitoring logins more closely).

 

There's a dsregmd /status and presumably your broken machines are not reporting a happy status?

 

A chap has also helped with parsing of that into powershell Powershell: Convert DsRegCmd to an object with a one-liner | OS|DC (osd-couture.com)

[Warwick_Tech]

There is a attribute in powershell to filter the personal devices which might help next time.

 

thanks, what I don't understand is around 90% of devices deleted were logged in way before the 180 days - I also discovered there's a 'disable' command instead of delete, so in future I'll run that as there is no recycle bin!

 

I don't mind these things being done via powershell, but I hate MS's insistence on removing anything GUI related

 

Ouch, that's harsh. My instinctive thought would have been that pending machines would just reconnect on next login, but if you have to disconnect and rejoin client side that's painful.

 

Yeah, you would think so, but they just get stuck in limbo waiting for a connection that never comes...

 

 

Anyway, my script so far is

 

if exist "C:\windows\AAD" goto :END

 

mkdir "C:\windows\AAD"

dsregcmd /leave

 

:END

 

Keep it simple I always say