How to Completely Disable ‘Device Registration’ (Workplace Join) via Group Policy in Windows 11

Device Registration (historically known as Workplace Join) is a feature in Windows 11 that allows users to associate their personal or unmanaged endpoints with a corporate Active Directory or Microsoft Entra ID (Azure AD) environment. This registration process provisions a cryptographic certificate on the device, granting seamless Single Sign-On (SSO) access to corporate resources and federated web applications without requiring full Mobile Device Management (MDM) enrollment. While useful for Bring Your Own Device (BYOD) policies, Device Registration introduces a severe operational security (OPSEC) liability in strict enterprise environments, military networks, or zero-trust deployments. Allowing unmanaged, potentially compromised endpoints to establish persistent cryptographic trust with the corporate directory bypasses endpoint compliance checks and creates a massive vector for lateral movement or data exfiltration.

This guide explains how to completely disable ‘Device Registration’ (Workplace Join) via Group Policy in Windows 11, enforcing a strict lockdown that prevents unmanaged hardware from generating trust certificates or associating with the corporate domain.

Disable Device Registration via Group Policy

To enforce a strict block that permanently neutralizes the Workplace Join APIs and prevents the OS from initiating the registration flow globally, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Device Registration

5. In the right-hand pane, locate the policy named Register domain joined computers as devices.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Windows authentication subsystem to actively reject all requests to initiate the Workplace Join discovery and provisioning protocol, ensuring the machine cannot register itself as a trusted endpoint in the directory).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting authentication and directory services require the OS to update its background tasks upon the next boot cycle.

Open Command Prompt as Administrator and run gpupdate /force, then reboot the machine. To verify the restriction is actively enforced at the registry level, you can launch Registry Editor (regedit.exe) and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin. You will find a DWORD value named autoWorkplaceJoin set strictly to 0. The Windows 11 workstation is now cryptographically prevented from initiating the Device Registration process, ensuring that only fully managed and compliant endpoints are permitted to authenticate against the corporate directory.