I've been seeing issues with AAD hybrid join failing. Win11 23H2 multi-session using MCS. I'm running dsregcmd /leave on the master before i snapshot it. this small delivery group only has a few VDAs. All are initially coming up with dsregcmd showing not AAD joined. some i can run /leave and /join and reboot and they're good. some i have to delete the device from entra and then wait for it to show up and /join again. here's dsregcmd /join /debug from device before i delete from entra: preCheckResult: Join deviceKeysHealthy: undefined isJoined: undefined isDcAvailable: YES isSystem: YES keyProvider: undefined keyContainer: undefined dsrInstance: undefined elapsedSeconds: 0 resultCode: 0x0 Automatic device join pre-check tasks completed. TenantInfo:Discover Join Info { TenantType = Managed; AutoJoinEnabled = 1; TenandID = blahblah; TenantName = workaccount.onmicrosoft.com } Join request ID: 2982be3a-9d20-4482-b156-d83e86f610cc Join response time: 04-10-2025 14026Z Join HTTP status: 400 Join error code: invalid_request Join error subcode: error_computer_signature_check_failure Join message: The verification of the signature failed for device blahblah in domain blahblah. Server operation: DeviceRenew DsrDeviceAutoJoin failed 0x801c005b. DsrCmdJoinHelper:Join DsrCmdDeviceEnroller::AutoEnrollSync failed with error code 0x801c005b. DSREGCMD_END_STATUS AzureAdJoined : NO EnterpriseJoined : NO

Did you modify the Workplace Join scheduled task to additionally run at startup as well as the at logon that exists?

You might be on to something 😋