Solved On wakeup I want Windows to ask for PIN instead of Password

d4005 · Jul 5, 2025

In the Windows Hello sign-in, I normally get asked to enter my PIN which I can do easily, stood up, with one hand.

When I've ran my works VPN though (GlobalProtect), it toggles something somewhere that changes the wake-up prompt to default to a password instead. Sure I can click on sign-on options and change it to PIN but it's then requiring reaching for the mouse, moving the cursor to the right place, clicking, selecting PIN, and then getting to enter it.

I'd much rather run something once every minute that toggles it back to asking for PIN. I do have a batch file that I run once a minute already for other reasons, so if I could drop it in there that'd be awesome.

Does anyone know if it's just a simple registry entry?

Everything I've Googled about this (even with the AI summary result) just talks about whether you're prompted or not, or how to add a pin. There's no result out there about when a VPN overrides the choice you made earlier and you want to toggle it back.

antspants · Jul 5, 2025

Have you run through this to make sure all is set correctly?

Enable or Disable Passwordless Sign-in for Microsoft Accounts in Windows 11

This tutorial will show you how to turn on or off only allow Windows Hello sign-in for Microsoft accounts for passwordless sign-in on your Windows 11 device. You can keep your device even more secure by removing passwords when signing in to Windows 11 with Microsoft accounts on your device. All...

www.elevenforum.com

antspants · Jul 5, 2025

d4005 said:
When I've ran my works VPN though (GlobalProtect), it toggles something somewhere that changes the wake-up prompt to default to a password instead.

Weird.

antspants · Jul 5, 2025

d4005 said:
(even with the AI summary result)

Did you come across this?

Create a scheduled task:

Trigger: At workstation unlock
Action: Run a dummy PowerShell script that simulates PIN sign-in usage.

Powershell:

Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait("{ESC}")

This keeps the PIN provider "warmed up", so it remains default next time.

There is also a reg hack, apparently risky? I have no idea why.

You can technically unregister the password credential provider, which forces PIN to be used. This is a bit aggressive and may lock you out if PIN fails.

Registry (not recommended unless you fully understand the risk):

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cf4-df0a320c9297}]
"Disabled"=dword:00000001

That GUID disables the password provider. To undo, set "Disabled"=0 or delete it.

When you checked AI, which AI? ChatGPT gave quite a few powershell and batch options, I asked it the following section of your post.

d4005 said:
In the Windows Hello sign-in, I normally get asked to enter my PIN which I can do easily, stood up, with one hand.

When I've ran my works VPN though (GlobalProtect), it toggles something somewhere that changes the wake-up prompt to default to a password instead. Sure I can click on sign-on options and change it to PIN but it's then requiring reaching for the mouse, moving the cursor to the right place, clicking, selecting PIN, and then getting to enter it.

I'd much rather run something once every minute that toggles it back to asking for PIN. I do have a batch file that I run once a minute already for other reasons, so if I could drop it in there that'd be awesome.

d4005 · Jul 5, 2025

antspants said:
You can technically unregister the password credential provider, which forces PIN to be used. This is a bit aggressive and may lock you out if PIN fails.

Registry (not recommended unless you fully understand the risk):

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cf4-df0a320c9297}] "Disabled"=dword:00000001

That GUID disables the password provider. To undo, set "Disabled"=0 or delete it.

When you checked AI, which AI? ChatGPT gave quite a few powershell and batch options, I asked it the following section of your post.

I didn't directly use an AI, it was just the AI summary that was at the top of the Google results (Gemini I expect).

Anyway, you're totally on the right track with the password credential provider. I did notice though that it wasn't the default password credential provider that needed disabling (actually it already was). For the first time ever I spotted that GlobalProtect itself is working as a credential provider as seen in this screenshot. A quick google of that led me here, where someone with this exact issue (using GlobalProtect) wanted to do the same thing. They also noticed that password credential provider was the place to go, but rather than disabling the standard provider, it said to disable the PanV2CredPr provider. I've done that now. If I later find that GlobalProtect spots what I've done and re-enables it, then a simple .reg file called up through my regularly running batch file will solve that.

Before and After disabling PanV2CredPr

antspants · Jul 5, 2025

Right, the concept is foreign to me, I’ve not had experience with what you’re facing (everything combined that is).

I take it that disabling both a pin or password after wake is a security risk for you?

You’ve probably contemplated this already?

Enable or Disable Require Sign-in on Wakeup in Windows 11

This tutorial will show you how to enable or disable to require sign-in on wakeup from sleep, hibernate, or Modern Standby for all users in Windows 11. To help secure your PC, Windows requires users to sign in on wakeup from sleep, hibernate, or resuming from Modern Standby (if supported) by...

www.elevenforum.com

antspants · Jul 5, 2025

Ahh yeah, that post above probably wont work due to the following?

d4005 said:
For the first time ever I spotted that GlobalProtect itself is working as a credential provider as seen in this screenshot.

d4005 · Jul 5, 2025

antspants said:
I take it that disabling both a pin or password after wake is a security risk for you?

You’ve probably contemplated this already?

Enable or Disable Require Sign-in on Wakeup in Windows 11

This tutorial will show you how to enable or disable to require sign-in on wakeup from sleep, hibernate, or Modern Standby for all users in Windows 11. To help secure your PC, Windows requires users to sign in on wakeup from sleep, hibernate, or resuming from Modern Standby (if supported) by...

www.elevenforum.com

Oh I definitely want some kind of security input. There's always the chance of someone stealing the laptop when it's in sleep mode. Sure a 4 digit PIN isn't the best security but it's something. My typical use case is to walk to where the laptop is, tap the keyboard to wake it up, enter the PIN and take a look at how it's getting on with what I left it doing, then do Windows+L to lock it again. That was significantly slowed down by the password prompt. Key is to have the 4 numbers of the PIN fairly close together. Something like 2918 is way less helpful to enter than 7898.

antspants · Jul 5, 2025

GlobalProtect integrates with Windows Hello (PIN, biometrics) or smart card authentication, but sometimes:

After waking from sleep, Windows may not fully reinitialize Windows Hello or the TPM in time.
GlobalProtect then falls back to password-based authentication because the PIN credential provider isn't ready yet.
Some versions of GlobalProtect may not support resuming with PIN or may be misconfigured.

I’m going to cheat, here are some AI offerings, I suppose at this point any suggestion could be promising:

Check GlobalProtect Client Version:

Older versions may have bugs or lack full support for Windows Hello.
Upgrade to the latest GlobalProtect client (check your IT admin or Palo Alto Networks support).

Sometimes the issue stems from how Windows resumes from sleep. Try:

Open Group Policy Editor (gpedit.msc)
Navigate to:
Computer Configuration > Administrative Templates > System > Power Management > Sleep Settings
Set "Require a password when a computer wakes (plugged in/on battery)" to Enabled.

Alternatively, go to:

Settings > Accounts > Sign-in options
Under “Require sign-in”, select “When PC wakes from sleep”, and test if that influences the login method.

If your system has multiple credential providers (PIN, password, smart card), Windows might not prioritize the PIN after sleep. You can:

Use tools like CredProvManager (from Microsoft or third-party) to adjust priority.
Or edit the registry, but this is risky and not recommended unless you're an IT pro.

Fast Startup can cause TPM/credential issues:

Go to Control Panel > Power Options > Choose what the power buttons do
Click “Change settings that are currently unavailable”
Uncheck “Turn on fast startup”
Reboot

Still Not Working?

If GlobalProtect is managed by your organization, your IT admin may have policy restrictions that enforce password use after wake.
You may need to contact them to enable Windows Hello authentication in the GlobalProtect portal/gateway configuration.

d4005 · Jul 5, 2025

antspants said:
GlobalProtect integrates with Windows Hello (PIN, biometrics) or smart card authentication, but sometimes:

After waking from sleep, Windows may not fully reinitialize Windows Hello or the TPM in time.

GlobalProtect then falls back to password-based authentication because the PIN credential provider isn't ready yet.

Some versions of GlobalProtect may not support resuming with PIN or may be misconfigured.

I’m going to cheat, here are some AI offerings, I suppose at this point any suggestion could be promising:

Check GlobalProtect Client Version:

Older versions may have bugs or lack full support for Windows Hello.

Upgrade to the latest GlobalProtect client (check your IT admin or Palo Alto Networks support).

Sometimes the issue stems from how Windows resumes from sleep. Try:

Open Group Policy Editor (gpedit.msc)
Navigate to:
Computer Configuration > Administrative Templates > System > Power Management > Sleep Settings

Set "Require a password when a computer wakes (plugged in/on battery)" to Enabled.

Alternatively, go to:

Settings > Accounts > Sign-in options

Under “Require sign-in”, select “When PC wakes from sleep”, and test if that influences the login method.

If your system has multiple credential providers (PIN, password, smart card), Windows might not prioritize the PIN after sleep. You can:

Use tools like CredProvManager (from Microsoft or third-party) to adjust priority.

Or edit the registry, but this is risky and not recommended unless you're an IT pro.

Fast Startup can cause TPM/credential issues:

Go to Control Panel > Power Options > Choose what the power buttons do

Click “Change settings that are currently unavailable”

Uncheck “Turn on fast startup”

Reboot

Still Not Working?

If GlobalProtect is managed by your organization, your IT admin may have policy restrictions that enforce password use after wake.

You may need to contact them to enable Windows Hello authentication in the GlobalProtect portal/gateway configuration.

Sorry, I already posted above that I now have the solution working(and marked it solved). I just had to disable the PanV2CredPr provider.

antspants · Jul 5, 2025

d4005 said:
Sorry, I already posted above that I now have the solution working(and marked it solved). I just had to disable the PanV2CredPr provider.

Ahh crap, so you did. My apologies. They told me I shouldn’t do anything that requires me to use my brain for a few days. But the operation was on my leg, perhaps after talking to me for a while the Surgeon concluded my brain is in my big toe. Entirely probable

Solved On wakeup I want Windows to ask for PIN instead of Password

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

​

​

​

Still Not Working?​

My Computers

Well-known member

​

​

​

Still Not Working?​

My Computer

Like a rolling drone.

My Computers

Still Not Working?

Still Not Working?