Solved Updated BIOS - now can't log in to windows??

glasskuter · May 1, 2022

@Calab Having to clean install is a drastic solution. The problem arose because you have not updated your security info in your Microsoft account. There, you need to have a valid email and phone number for times you require account recovery. If they can't verify you by email, they send a code to your phone. If you have neither listed, you will run into the same issue the next time you need to change your pin or password. https://account.microsoft.com

johnlgalt · May 1, 2022

Dru2 said:
Ok, so I'm red faced and humbly eating my words...

Allow me a caveat though as this really is a first! It's the first BIOS change I did under Windows 11. And this new Gigabyte release for my Gigabyte Aorus Z390 Xtreme is different from others and is irreversible as shown in the release notes...

In a nutshell it features vulnerability fixes and also introduces new tech, which at the end of the day DID require me to recreate a new PIN with Windows telling me "Your PIN is no longer available due to a change to the security on this device. Click to set up your PIN again."

This is a first for me, and I don't know if it's a Windows 11 thing, a new BIOS thing, or both. But yes... I DID have to re-create my Pin

Apologies, I've been proven wrong here.

However, this still stands (for now). And the last BIOS update for my Lenovo was 7/15/2021. Windows 11 Dev channel installed Oct.

BTW, that "Capsule BIOS support" thing sounds like an introduction to BIOS updates through Windows Update. But the article I read is somewhat clear as mud to me - Windows UEFI firmware update platform - Windows drivers

Dru, now you're seeing what I was seeing a lot of before I bought the Physical TPM module for my motherboard, and coincidentally right before they released a UEFI fw update that had listed "Windows 11 support" lol.

I had extensive issues with being able to reset the Windows Hello PIN a couple of times, in that I had to actually remove 2 work accounts and re-add them after resetting my PIN for private accounts. It was a massive PITA for me then, and is the reason that I finally bit the bullet and got the physical TPM solution. For those using AMD's fTPM, there have been other issues, as well, including (for whatever reason) reports of the fTPM in UEFI causing machines to stutter during heavy workloads (primarly gaming), that the latest AMD AGESA (1.2.0.7) is supposed to have fixed, but which requires yet another firmware update. MSI has not released this fix publicly yet, but it is available from their Google Drive share with a lot of the other Beta fw updates, too.

However, since moving to the physical TPM solution, these weird (and admittedly inconsistent) issues with Windows Hello have gone away permanently. I've since flashed 3 more UEFI fw updates since getting that phyusical TPM and Windows never once had an issue with my PIN. Whether that is because the UEFI fw updates are now Windows 11 compatible, or whether it is because rI'm using hte physical TPM module, I cannot say for certain. But, it makes sense that if the AGESA is updated in the UEFI fw, then it will require 'resetting' the fTPM side of things, just as every other setting in the UEFI is reset to default as well. This was my conjecture way back then, and I still hold to it - as I'm not willing to test by removing my physical TPM solution, setting a new PIN, then updating the fw again, it will have to remain conjecture, at least from my side.

The good news is that the physical TPM modules are getting closer to prices pre-COVID, I've seen then as low as 15 USD now (mine was originally around 13 USD when I bought the mobo, but when I bought it it was more like 22 USD - thanks scalpers).

Dru2 · May 1, 2022

@johnlgalt, thanks for the info. That said note my system is Intel, not AMD so no AGESA there. Also, (for me) having already ran a physical TPM module on my system, it tended to slow my system so for that reason, and knowing how easy it is to fix the issue, I'll stick with fTPM. That's me.

Also that BIOS also introduced new capabilities, so perhaps that played a role? Maybe/maybe not. This is the BIOS I updated to (F9)...

Anyway, when I bought my module back in 2017, I paid $27 bucks for it. I see today Amazon is charging $47 for the same module....

Today the same module is going for 47 bucks!!!

johnlgalt · May 2, 2022

Yeah, wasn't saying you were experiencing it because of AGESA - but now that we've had both AMD builds (with the fTPM bug causing stuttering) experience issues, and Intel PTT-based builds also have issues, it's becoming more clear that Windows 11 was quite possibly released too early.

As for hardware TPM modules, surprised your system is taking a hit, mine is the opposite, performance is much better overall. Of course, yours is also a 20 pin (technically 19) whereas the ones I was showing for MSI boards are either 12 or 14 pin, so also another reason for a price difference.

Still, yeah, I saw the MSI-compatible ones briefly hit as high as $35 for a $15 chip lol. Surprised your model is still that high. Scalpers, man....

Fabler2 · May 2, 2022

There's been a few posts here showing alternative log-in on the Lock screen to use your Microsoft account password as an alternative to at least get to verify the account to get out of trouble. I wonder what would have happened if the setting for 'For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device (recommended)' had been turned on - in Accounts - sign-n options - additional settings?
If it is on then might well be worth turning off before flahing the BIOS just in case?

I changed the PIN on one of my laptops from a four character length to a six character length and cutting a long story short restored from an earlier Macrium image. It took the original four character PIN to log in.

johnlgalt · May 2, 2022

Yeah, but those accounts were both unable to log in and trying to reset / disable the PIN took it for a loop. Believe me, I went through everything I could to try to make them work. My personal accounts allowed me to reset the PIN without issues - but I suspect that the work account,s being tied to work domains and work policies, were breaking because of an inefficient manner of trying to authenticate from a brand new OS that the works systems could not handle. It happened twice early one, but then the reset functions started working better and I did not have to remove the accounts.

Dru2 · May 2, 2022

johnlgalt said:
Yeah, but those accounts were both unable to log in and trying to reset / disable the PIN took it for a loop. Believe me, I went through everything I could to try to make them work.

For me, in the end all I needed to do was create pin and the issue was gone. No account deletes or any of that stuff.

I was just initially baffled as to why I needed to reset the pin in at all after a BIOS update, when no such behavior ever occurred before under Windows 10. And I've done quite a few BIOS updates on different machines under Windows 10.

The first BIOS update I do under Windows 11, and I got the "Your PIN is no longer available due to a change to the security on this device. Click to set up your PIN again." as seen in post #25. That was the baffling part to me. Simply doing what it said, all was good.

NavyLCDR · May 2, 2022

Burgurne said:
First, when this happens, there is NO other way to login. "Forgot your PIN-code"-option is not there, using another login method is not there, shifting to another user is not there. The ONLY active thing on the login screen is "Click here to reconfigure PIN-code". After reading all your posts here, I tried to change the settings in TPM save reboot into BIOS load default, save reboot into BIOS. TPM and SecureBoot are NOT affected by "load default setting". I then clean-installed Windows 11, and when it was up and running, I tried to disable TPM, and then the error came back at next boot. BUT !!!! when I here clicked on "Click here to reconfigure PIN-code", after some seconds a new window opened and let me login with my password and then make a new PIN-code.
Hmmm, it seems that my newest backup of Windows11 has an error. I then tried to take my backups backwards, and YES, a backup 3 weeks old did the same and let me login with this "new" window on the login screen. Thank you for pointing me in the right direction

But, error in my Windows 11 or not, if a BIOS update can cause this, many others will have problems, as windows 11 come with warnings "Are you SURE you want to change your PIN-code?" and some more, and I think that people not used to fiddle around with stuff like this, will back down from trying.

Option 5:

Enable or Disable Built-in Administrator Account in Windows 11 Tutorial

This tutorial will show you how to enable or disable the built-in Administrator account in Windows 11. Windows 11 includes a hidden built-in Administrator account that serves as the local system administrator with elevated rights by default without needing Run as administrator or UAC (User...

www.elevenforum.com

Then use the built-in administrator account to adjust your normal account's login settings?

windowsgoodbye · May 2, 2022

glasskuter said:
@Calab The problem arose because you have not updated your security info in your Microsoft account. There, you need to have a valid email and phone number for times you require account recovery. If they can't verify you by email, they send a code to your phone. If you have neither listed, you will run into the same issue the next time you need to change your pin or password. https://account.microsoft.com

I encountered this issue after a bios update. I am unable to reset using the Microsoft Account or Phone number because it requires online access and I have Malwarebytes Windows Firewall Control installed with High Filtering enabled at boot. Says, no internet. No other options except to reboot.

The only 'repair' solution in a situation like this would be to gain administrative console access. Maybe this will work:

1) Boot into Windows Recovery Environment (hold shift while rebooting from login screen, navigate to recovery console)
2) move C:\Windows\System32\Utilman.exe C:\
3) copy C:\Windows\System32\cmd.exe C:\Windows\System32\Utilman.exe
4) Reboot, click on the Accessibility Icon at Login screen

From there you can either:

1) Reset the Windows Firewall config with: netsh advfirewall reset
Then reboot and internet access should be reenabled
2) If that doesn't work, or if you are unable to reset by logging into the Microsoft account:
Enable local login access by modifying registry @ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device
Set DevicePasswordLessBuildVersion from 2 to '0'
Then, reset the user account password: net user accountname newpassword
Reboot and login
3) Create a new administrative account, login, disable High Filtering mode if necessary, reboot and continue with password reset.

After that, don't forget to copy utilman.exe on C:\ back to C:\Windows\System32

This is all dependent on the utilman.exe trick still working. I am unsure if it does with this particular situation and have not yet had time to try it, but will update if it is successful for me. Hopefully this is useful to some of you.

I do not care for the difficulty this has caused and I will be disabling Windows Hello on all devices and will never use it again. I've worked in IT on and off since the 90's. I foresee issues for years to come with this implementation for people in situations such as trying to restore backup images on devices with failed hardware for family friends residential customers etc... Way too easy to forget your password using a PIN or biometric login all the time. This type of security is more likely to cause people lock themselves out than any supposed security risk.

Dru2 · May 2, 2022

windowsgoodbye said:
I encountered this issue after a bios update. I am unable to reset using the Microsoft Account or Phone number because it requires online access and I have Malwarebytes Windows Firewall Control installed with High Filtering enabled at boot.

I don't know why yours is doing that as I certainly didn't have to do it, and I have 2FA enabled. All I had to do was log into my account using my Microsoft password and change the pin number to log into Windows. That's it. Not sure why yours or Calab was different?

Also, do you not have any other PCs/tablets, cell phones to access your email account online?

glasskuter · May 2, 2022

windowsgoodbye said:
I do not care for the difficulty this has caused and I will be disabling Windows Hello on all devices and will never use it again

I am in total agreement. If you've read any of my rants about pin and tpm, you will understand why. I'm one of it's victims. Passwords are the only way to go.

Dru2 · May 2, 2022

I think understanding how things work and knowing what to expect when certain procedures are performed makes the task easier. For me, now knowing I may have to reset a pin during a BIOS won't be such a surprise, and especially since I know how easy it is to solve.

My two cents.

obelix · May 2, 2022

When you buy or get a motherboard in the BIOS, TPM is not included or you have to turn on security yourself, at least that's how it was with me i was never in the BIOS on the ASUS motherboard rename the BIOS file and everything was always ok.

glasskuter · May 2, 2022

Dru2 said:
I think understanding how things work and knowing what to expect when certain procedures are performed makes the task easier.

The thing is so many don't understand. When it happens, their lack of understanding can make matters worse. Just like with 2 step verification. Many do not know how important it is to keep their MS account updated with telephone number changes or email address changes. Many do not even have it set up in the first place. It can be a game saver those times it is needed.

Dru2 · May 2, 2022

glasskuter said:
The thing is so many don't understand. When it happens, their lack of understanding can make matters worse. Just like with 2 step verification. Many do not know how important it is to keep their MS account updated with telephone number changes or email address changes. Many do not even have it set up in the first place. It can be a game saver those times it is needed.

Then why use something you don't understand and don't want to keep up with. Yeah I know the easy answer is "cause we're forced to" but you aren't forced to do anything, you choose to do because you want to use a product. So why not learn the basics?

We all had to learn from the beginning, and continue to learn. Thus as I'm fond of saying, owning a PC is an active endeavor, not a passive one. You also learn from experiences, which is what my post is about that you quoted.

My two cents.

windowsgoodbye · May 2, 2022

windowsgoodbye said:
1) Boot into Windows Recovery Environment (hold shift while rebooting from login screen, navigate to recovery console)

2) move C:\Windows\System32\Utilman.exe C:\

3) copy C:\Windows\System32\cmd.exe C:\Windows\System32\Utilman.exe

4) Reboot, click on the Accessibility Icon at Login screen

From there:

1) Enable local login access by modifying registry @ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device

2)Set DevicePasswordLessBuildVersion from 2 to '0'

3) reset the user account password: net user accountname newpassword

4) Reboot, you will now have the option to login via password

After that, don't forget to copy utilman.exe on C:\ back to C:\Windows\System32, or run sfc /scannow and Windows will do it for you.

Confirming that this is a working solution.

I'm out folks, hope this is helpful to those of you who need it.

Hollywood · May 2, 2022

windowsgoodbye said:
I encountered this issue after a bios update. I am unable to reset using the Microsoft Account or Phone number because it requires online access and I have Malwarebytes Windows Firewall Control installed with High Filtering enabled at boot. Says, no internet. No other options except to reboot.

The only 'repair' solution in a situation like this would be to gain administrative console access. Maybe this will work:

1) Boot into Windows Recovery Environment (hold shift while rebooting from login screen, navigate to recovery console)
2) move C:\Windows\System32\Utilman.exe C:\
3) copy C:\Windows\System32\cmd.exe C:\Windows\System32\Utilman.exe
4) Reboot, click on the Accessibility Icon at Login screen

From there you can either:

1) Reset the Windows Firewall config with: netsh advfirewall reset
Then reboot and internet access should be reenabled
2) If that doesn't work, or if you are unable to reset by logging into the Microsoft account:
Enable local login access by modifying registry @ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device
Set DevicePasswordLessBuildVersion from 2 to '0'
Then, reset the user account password: net user accountname newpassword
Reboot and login
3) Create a new administrative account, login, disable High Filtering mode if necessary, reboot and continue with password reset.

After that, don't forget to copy utilman.exe on C:\ back to C:\Windows\System32

This is all dependent on the utilman.exe trick still working. I am unsure if it does with this particular situation and have not yet had time to try it, but will update if it is successful for me. Hopefully this is useful to some of you.

I do not care for the difficulty this has caused and I will be disabling Windows Hello on all devices and will never use it again. I've worked in IT on and off since the 90's. I foresee issues for years to come with this implementation for people in situations such as trying to restore backup images on devices with failed hardware for family friends residential customers etc... Way too easy to forget your password using a PIN or biometric login all the time. This type of security is more likely to cause people lock themselves out than any supposed security risk.

I have Windows 11 Pro with a local account and logon password. If someone had physical access to my computer could they use this method to start windows and change my password (to gain access to my desktop, files, and programs)?

Winuser · May 2, 2022

windowsgoodbye said:
2) move C:\Windows\System32\Utilman.exe C:\
3) copy C:\Windows\System32\cmd.exe C:\Windows\System32\Utilman.exe

Move and copy to were?

glasskuter · May 2, 2022

Hollywood said:
could they use this method to start windows and change my password

yep, if they know how.

Hollywood · May 2, 2022

glasskuter said:
yep, if they know how.

well doesn't this mean all of this security means nothing? I've heard in the past of people bringing their computers in for repair stating they forgot their password and the tech said not to worry and was able to reset it. With all of this TPM and other security this still can't be the case, can it?