If you join a new PC to Azure AD during the initial Windows 10 configuration, the device is listed under it's original name, e.g. DESKTOP-NNNNN. If the computer is then renamed (as is common practise), Azure AD is not updated. If one then needs the Bitlocker key (which is saved in AZ), then you're stuck unless you know the original name. This is a known problem.

Is there someway to find the Device Id from the PC? Somewhere in the registry or a PowerShell cmdlet?

enter image description here

Of course, if you're in a situation where the user has asked for their Bitlocker key, you're doubly stuffed because they won't be able to get to the desktop or PowerShell anyway! I've added recording the original name to our set-up procedure for new kit so this is more for laptops that have already been done.

I'm aware that the workaround is to set-up Windows using a local account, rename the computer, then add to Azure AD and then delete the local account. A faff but it's the best we've got so far.

  • On a machine where I do know the DeviceId, I was able to find that HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo contains a key with the device Id. Not great but it will do – munrobasher Sep 12 '17 at 16:16

If these are Win10 machines open a command prompt try: dsregcmd /status


I also ran into this issue when trying to rename Azure AD devices. Following @munrobasher's comment, the Device ID can be found as a key name at the following registry location:


This is an obtuse way to get an Azure AD Device Object ID from the current device, but I couldn't find anything supported by Microsoft as of writing this comment.

# Get current device's Azure Device Object ID
$AzureADDeviceDeviceID = (Get-ChildItem -Path "hklm:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo\" | select pschildname).PSChildName
$AzureADDeviceObjectID= (Get-AzureADDevice | Where-Object {$_.DeviceId -match $AzureADDeviceDeviceID}).ObjectId

Is the machine booting that you still have access to it? Or does bitlocker prevent you from getting in at all? If you can get in, you could run this Powershell that parses the Netsetup.log file to learn the original machine name:

select-string "SamAccountName" C:\windows\debug\NetSetup.LOG

It will show several lines that contain the original name, and then one line with the current name.

What does the drive recovery screen look like on Windows 10? I Recently encountered a Win7 machine in need of assistance it shows the original machine name as the first part of the "drive label" field.

  • Yes, the laptops are still alive so I can get to them. I don't have a disaster at the moment but if somebody did call up and ask for the key for LAPTOPxxx, I'd be rather stuck – munrobasher Jun 30 '17 at 14:28
  • NetSetup.log is there but doesn't have any details of joining the Azure AD domain. Has the original workgroup – munrobasher Sep 12 '17 at 16:07
$DsregCmdStatus = dsregcmd /status
if($DsregCmdStatus -match "DeviceId")
$DeviceId = $DsregCmdStatus -match "DeviceID"
$DeviceId = ($DeviceId.Split(":").trim())
$DeviceId = $DeviceId[1]

$DeviceID would have your AAD Device id value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.