<aside> 🧭

Not sure which Windows setup you need? Start with Windows: Which Setup Do I Need? (Start Here). It takes 2 minutes and tells you which path to follow, so you don't set up Entra or a domain you don't need. This page is for admins scoping a fleet-wide rollout.

</aside>

Before rolling out passwordless, it helps Allthenticate's team scope the deployment correctly if we have a clear picture of two things on your fleet:

1. How your devices are joined — on-prem AD only, Entra joined, hybrid (joined to both AD and Entra), or workgroup/standalone
2. What accounts your users sign into Windows with — AD domain accounts, local accounts created on each machine, or a mix; and who has local admin privileges

📝 Fastest path: fill out our short Windows Environment Scoping Form. It takes about 3 minutes, lets you pick from preset answers, and you can attach the CSVs from the fleet-wide checks below if you ran them. Prefer to do it the long way? Read on.

This page walks through how to answer both questions. Each section has two paths: a single-machine check anyone on your team can run in a couple of minutes, and a fleet-wide check for capturing the full picture across your environment. Either level of detail is useful — use whatever's easier on your end.

🖥️ Question 1: How are your devices joined?

Knowing the join state tells us whether identity for each machine lives in on-prem AD, in Entra, in both (hybrid), or nowhere managed at all (workgroup). This shapes how Allthenticate Desktop integrates with your sign-in flow.

Single machine — check one Windows device

1. Open Command Prompt (no admin rights needed)

2. Run:

   dsregcmd /status
   

3. In the output, look at the top section for these three lines:

   Field	What it means
   AzureAdJoined : YES/NO	Whether the machine is joined to Microsoft Entra (cloud)
   EnterpriseJoined : YES/NO	Legacy on-prem federation; almost always NO in modern environments
   DomainJoined : YES/NO	Whether the machine is joined to on-prem Active Directory

How to interpret the result:

• DomainJoined: YES and AzureAdJoined: NO → Pure on-prem AD-joined (most common with Connect Sync)
• DomainJoined: YES and AzureAdJoined: YES → Hybrid joined
• Both NO → Workgroup / standalone — the machine isn't managed by AD at all (worth flagging)

Fleet-wide — export every machine AD knows about

1. Sign in to a Domain Controller (or any machine with the RSAT Active Directory PowerShell module)
2. Open PowerShell as Administrator