Queries Windows 10 devices with dsregcmd, parses the output and determines if a device has the authentication state of either a local user only, local user registered with Azure AD, Azure AD joined, domain joined only, hybrid joined with Azure AD, domain joined with user registered with Azure AD or DRS on-prem.

Get-AuthState.ps1

$dsregcmd = dsregcmd /status | Where-Object { $_ -match ' : ' } | ForEach-Object { $_.Trim() } | ConvertFrom-String -PropertyNames 'Name','Value' -Delimiter ' : '

$joinType = 0
if ( ($dsregcmd | Where {$_.Name -eq 'EnterpriseJoined'}).Value -eq 'YES' ) {
	$joinType = 4
} else {
	if ( ($dsregcmd | Where {$_.Name -eq 'AzureAdJoined'}).Value -eq 'YES' ) {
		if ( ($dsregcmd | Where {$_.Name -eq 'DomainJoined'}).Value -eq 'YES' ) {
			$joinType = 3
		} else {
			$joinType = 1
		}
	} else {
		if ( ($dsregcmd | Where {$_.Name -eq 'DomainJoined'}).Value -eq 'YES' ) {
			if ( ($dsregcmd | Where {$_.Name -eq 'WorkplaceJoined'}).Value -eq 'YES' ) {
				$joinType = 6
			} else {
				$joinType = 2
			}
		} else {
			if ( ($dsregcmd | Where {$_.Name -eq 'WorkplaceJoined'}).Value -eq 'YES' ) {
				$joinType = 5
			}
		}
	}
}

Switch ($joinType) {
	0 {"Local Only"}
	1 {"AAD Joined"}
	2 {"Domain Only"}
	3 {"Hybrid AAD"}
	4 {"DRS"}
	5 {"Local;AAD Reg"}
	6 {"Domain;AAD Reg"}
}