Lost local administrator rights on Microsoft Entra Joined Windows 11 device after UPN change

Question

Lost local administrator rights on Microsoft Entra Joined Windows 11 device after UPN change

Els Stuiver 0

I have a Microsoft Entra Joined Windows 11 device named LaptopSunenFit.

I am the Global Administrator and Device Owner.

Before changing my UPN from:

******@sunenfitleefstijlcoaching.onmicrosoft.nl

to

******@sunenfit.nl

I had local administrator rights on the device.

The issue started immediately after changing the UPN from ******@sunenfitleefstijlcoaching.onmicrosoft.nl to ******@sunenfit.nl.

Immediately after the UPN change, my account lost local administrator rights.

The device still shows:

AzureAdJoined = YES DeviceAuthStatus = SUCCESS

Additional findings:

whoami /groups does not show BUILTIN\Administrators
net localgroup administrators shows only Administrator
The built-in Administrator account is disabled
Windows LAPS is disabled
No other local administrator account exists
The device is not managed by Intune

I am still able to sign in to Windows and to Microsoft Entra. My account remains the Global Administrator and Device Owner.

Is there a supported way to restore local administrator rights on this Microsoft Entra Joined device without resetting or re-enrolling the device?

Any guidance would be appreciated.

Kind regards,

Els Stuiver

0 comments

1 answer

Your answer

Answer 1

Yes. The supported recovery path is to force the device to obtain a new Primary Refresh Token (PRT) so the local administrator role claims are refreshed.

What the current findings indicate:

whoami /groups not showing BUILTIN\Administrators means the current sign-in token does not contain local administrator membership.
On Microsoft Entra joined devices, users assigned the Microsoft Entra Joined Device Local Administrator role receive those permissions through the PRT, not by being directly listed in the local Administrators group.
Changes to this role do not apply immediately on an already signed-in device. A new PRT and a full sign-out/sign-in are required.

Supported steps:

Verify the account is assigned the local admin role in Microsoft Entra:
- Go to Entra ID > Devices > All devices > Device settings.
- Select Manage Additional local administrators on all Microsoft Entra joined devices.
- Confirm the user or an assigned role-based group is present.
Check whether the device is still using an older cached PRT:
- Open Command Prompt.
- Run:
```
     dsregcmd /status
```
- In the output, check the SSO State section and review AzureAdPrtUpdateTime.
Refresh the PRT immediately:
- In Command Prompt, run:
```
     dsregcmd /refreshprt
```
- Expected message: PRT refresh scheduled. Check AAD event logs for details.
Wait 1 to 2 minutes.
Sign out of Windows completely, then sign back in.
- A lock/unlock is not sufficient.
Verify the refreshed token:
- Run:
```
     whoami /groups
```
- Confirm BUILTIN\Administrators now appears.

If immediate refresh is not used, the documented behavior is that CloudAP renews the PRT every four hours. After that renewal, a sign-out and sign-in is still required.

Important limitation:

The Microsoft Entra Joined Device Local Administrator role applies to all Microsoft Entra joined devices and cannot be scoped to only one device.
Users are not directly listed in the local Administrators group when this role is granted through Microsoft Entra; the privilege comes from the PRT.

If the account was never assigned under Additional local administrators on all Microsoft Entra joined devices, add it there first, then perform the PRT refresh and sign out/sign back in sequence.