Windows 11 Hybrid Join and Intune: GPO Enrollment and DNS Suffix Recovery

Estimated reading and study time: 50–65 minutes. Allow time to review 57 slides, inspect the evidence and absorb the concepts. This estimate excludes reproducing the procedures and waiting for installation, synchronization or policy delivery.

This Windows 11 lab follows AD DS domain join, GPO-based Microsoft Intune enrollment and recovery from domain sign-in error 1787. It traces an incorrect primary DNS suffix delivered by Intune, the explicit replacement of that value and the subsequent restoration of domain access on the lab endpoint.

Read the recovery sequence as evidence for this device and observation period. Final Hybrid Join and PRT validation, directory DNS/SPN checks and overall compliance remain follow-up items. Restored sign-in should not be expanded into a claim of complete hybrid identity health or a fleet-wide root cause.

Related learning: For hybrid identity and connectivity background, read the Autopilot Hybrid conceptual guide; its deployment route differs from this GPO enrollment route. Compare Hybrid infrastructure preparation and OOBE execution and identity verification for related validation patterns.

Official documentation: Use Microsoft’s GPO-based automatic MDM enrollment instructions for this enrollment method and Autopilot Hybrid requirements for the related deployment scenario. Keep the two workflows distinct when planning your checks. Use the dsregcmd reference for the pending device identity and PRT checks. A 57-slide lab walkthrough of AD DS domain join, GPO-based Intune enrollment and recovery from domain sign-in error 1787. The evidence traces an incorrect primary DNS suffix delivered by Intune, its explicit replacement and restored domain access. Final Hybrid Join and PRT validation, directory DNS/SPN checks and overall compliance remain separate follow-up items.