Solved Updated BIOS - now can't log in to windows??

I read somewhere that as long as Windows Defender is turned on it no longer works, but I can not verify that. I have used this method a few times in the past but it was on local accounts not MS accounts. Even if it no longer works, it is still possible to activate the hidden administrator account using an iso so that's another backdoor to gaining access into machines. There will always be backdoors when one has physical access. All the security MS is pushing is not for when someone has physical access to your machine, but for threats coming from the outside. It's the hackers they are concerned with.

glasskuter said:

There will always be backdoors when one has physical access. All the security MS is pushing is not for when someone has physical access to your machine, but for threats coming from the outside. It's the hackers they are concerned with.

Click to expand...

Thanks for the reply. That is not comforting. Would that method also work with computers that have the system drive encrypted with BitLocker?

Hollywood said:

Thanks for the reply. That is not comforting. Would that method also work with computers that have the system drive encrypted with BitLocker?

Click to expand...

What's conveniently left out of that equation is the end user's responsibility for securing their machine. Microsoft actually does provide tools to secure a "physically possessed PC". The problem is some push these tools as the boogieman or opine with a bunch of false what ifs, and maybe so's to scare people from using said tools.

BitLocker for example can secure your drives so that if the machine is physically taken, the drives can't be accessed without a pass key. And I can assure you pulling the drive and putting it in another machine WILL NOT override a BitLockered drive. Been there done that!!!

Yeah, there are probably some high-level tools possessed by trained specialists who can bypass specific security measures, but I seriously doubt they're seeking out small fry home PCs.

I'm not sure it would work if you've set the device to PIN only.

Fabler2 said:

I'm not sure it would work if you've set the device to PIN only.

Click to expand...

If you're addressing this to me, BitLocker and Windows Hello (Pin) are separate and different entities. Windows Hello is for logging into the OS. BitLocker is for encrypting a drive. The two don't rely on each other and can be done without need of the other.

Dru2 said:

If you're addressing this to me, BitLocker and Windows Hello (Pin) are separate and different entities. Windows Hello is for logging into the OS. BitLocker is for encrypting a drive. The two don't rely on each other and can be done without need of the other.

Click to expand...

Sorry should have been more specific, referring to @windowsgoodbye's password workaround. The device set to PIN only it shouldn't work.

Booted to the Hidden Admin obviously get's you to all the data but noticed that you can't change the original admin's account's password. Do't know if it's because it's Pin locked.

How easy is it in Win 11 to get to the Hidden Admin account if you can't log in?
This on a non encrypted drive.

​

Fabler2 said:

How easy is it in Win 11 to get to the Hidden Admin account if you can't log in?
This on a non encrypted drive.

Click to expand...

I've no idea, as I've not needed that, but...


@Brink, do you have a tutorial for this?

Dru2 said:

I've no idea, as I've not needed that, but...

How to enable the hidden Windows 11 administrator account - gHacks Tech News

Find out how to enable the secret administrator account of the Windows 11 operating system, and how to set password for the account.

www.ghacks.net

@Brink, do you have a tutorial for this?

Click to expand...

Thanks for that but I was looking for opton 5 here and the open command at boot link. Seems if you don't encrypt your drive your data is easily accessible with a PIN enabled or not.

Dru2 said:

I've no idea, as I've not needed that, but...

How to enable the hidden Windows 11 administrator account - gHacks Tech News

Find out how to enable the secret administrator account of the Windows 11 operating system, and how to set password for the account.

www.ghacks.net

@Brink, do you have a tutorial for this?

Click to expand...

Oh yes.

Brink said:

Oh yes.

Enable or Disable Built-in Administrator Account in Windows 11 Tutorial

Windows 11 includes a hidden built-in Administrator account that serves as the system administrator with elevated rights by default without needing Run as administrator or UAC (User Account Control) for elevation approval. The built-in Administrator is not protected by a password by default...

www.elevenforum.com

Click to expand...

Dats the one I posted

Brink said:

Oh yes.

Enable or Disable Built-in Administrator Account in Windows 11 Tutorial

Windows 11 includes a hidden built-in Administrator account that serves as the system administrator with elevated rights by default without needing Run as administrator or UAC (User Account Control) for elevation approval. The built-in Administrator is not protected by a password by default...

www.elevenforum.com

Click to expand...

Thanks. I couldn't find it, thus my link.

Thanks

Fabler2 said:

Seems if you don't encrypt your drive your data is easily accessible with a PIN enabled or not.

Click to expand...

Which is what I said, and why I said BitLocker and Windows Hello are two different entities

Dru2 said:

For me, in the end all I needed to do was create pin and the issue was gone. No account deletes or any of that stuff.

I was just initially baffled as to why I needed to reset the pin in at all after a BIOS update, when no such behavior ever occurred before under Windows 10. And I've done quite a few BIOS updates on different machines under Windows 10.

The first BIOS update I do under Windows 11, and I got the "Your PIN is no longer available due to a change to the security on this device. Click to set up your PIN again." as seen in post #25. That was the baffling part to me. Simply doing what it said, all was good.

Click to expand...

Dru2 said:

I don't know why yours is doing that as I certainly didn't have to do it, and I have 2FA enabled. All I had to do was log into my account using my Microsoft password and change the pin number to log into Windows. That's it. Not sure why yours or Calab was different?

Also, do you not have any other PCs/tablets, cell phones to access your email account online?

Click to expand...

Dru2 said:

I think understanding how things work and knowing what to expect when certain procedures are performed makes the task easier. For me, now knowing I may have to reset a pin during a BIOS won't be such a surprise, and especially since I know how easy it is to solve.

My two cents.

Click to expand...

Dru2 said:

Then why use something you don't understand and don't want to keep up with. Yeah I know the easy answer is "cause we're forced to" but you aren't forced to do anything, you choose to do because you want to use a product. So why not learn the basics?

We all had to learn from the beginning, and continue to learn. Thus as I'm fond of saying, owning a PC is an active endeavor, not a passive one. You also learn from experiences, which is what my post is about that you quoted.

My two cents.

Click to expand...

Dru2 said:

What's conveniently left out of that equation is the end user's responsibility for securing their machine. Microsoft actually does provide tools to secure a "physically possessed PC". The problem is some push these tools as the boogieman or opine with a bunch of false what ifs, and maybe so's to scare people from using said tools.

BitLocker for example can secure your drives so that if the machine is physically taken, the drives can't be accessed without a pass key. And I can assure you pulling the drive and putting it in another machine WILL NOT override a BitLockered drive. Been there done that!!!

Yeah, there are probably some high-level tools possessed by trained specialists who can bypass specific security measures, but I seriously doubt they're seeking out small fry home PCs.

Click to expand...

This is more than just basic education though. Microsoft made is extremely easy to upgrade to Windows 11 from previous versions if your hardware supported it. However, Microsoft did not make it super easy if you have certain scenarios in place.

I had issues with the UEFI fw updates more than a few times. Most of the time it was a simple reset your PIN and done. A couple of times I had the issue as described. The word was that if the Windows 11 installer found supported components it would install - it never told you that a subsequent update to your UEFI fw when using firmware-based TPM may, in fact, reset the TPM stored credentials and force you to have to reset your access when using Windows Hello - or that said access may be broken beyond repair if you're also connected to work / school accounts with strict policies, like "Allow my organization to manage my device" enforced.

A couple of other things that we did not know is that the current UEFI fw out there, while being listed as Windows 11 compatible, were not necessarily slated to work with Windows 11, as noted by my own experiences and how the fw update released not too long after I purchased a physical TPM module specifically listed Windows 11 compatibility in the change log. And previous to this there was no requirement for using TPM, and very loose requirements for using Secure Boot.

Cannot educate the user on scenarios that you don't know about. Users cannot educate themselves on something that is relatively new and untested. And before you try to say "Don't upgrade" if your hardware has died and you're forced to buy a new machine, well, that kinda gets in the way of that admonishing to not upgrade. I'm tech savvy, and I was able to figure out what I needed to do. Others are not - and there is only so much they can learn about when little things like this do not get reported to Microsoft so they can be actioned upon, if they choose to.

These kinds of things are not the users' fault solely - plenty of people keep saying things like "Yeah, you can use fTPM / PTT perfectly fine, there's no issue. And for the most part, for most people, it *will* be fine. They won't have convoluted setups like mine, with multiple external account setups plus my personal stuff, if they can they'll have separate, dedicated machines. But, then, what happens when Windows Update comes along and throws a fw update directly to your machine? What happens when someone works for an organization that required 'managing your device' when working from home? What happens when you're forced to work from home because of a pandemic?

It was a perfect storm situation - so many factors came together to make this happen. But it definitely is not the sole bailiwick of the end user in this case, with these scenarios. This was a major problem that was overlooked when Microsoft ran their extremely short Beta test for Windows 11 before launching it. This kind of thing should never have happened to anyone, but *particularly* not during a pandemic when people are working from home and have only limited, basic OTA access to IT staff.

There's always going to be exceptions to the rule that no one saw coming. That's life whether you're a doctor, or PC programmer. I'm simply speaking on the "generally speaking" of owning a PC... it's an active endeavor, not a passive one. If you own a PC take a minute to figure out the stuff you use. Don't do things you're not comfortable with unless you have some basics for getting yourself out of trouble.

No one on the planet can cover all the what ifs and maybe so's, but some basics go a long way in helping you out a jam. I always remember my boot camp instructor saying when you're in trouble "remember your training". Doesn't mean its always going to work, but it goes a long way in giving you a chance. This is the attitude I bring to anything I do, including using PCs. That's me.

I don't have the answers to all the issues I run into / may run into, but I'm confident I can figure it out because have some basic knowledge on the stuff I use. And yes, forums help as well.

My two cents.

I have probably solved my problem, I could not change PIN, because I had User Data services disabled along with task CacheTask.
As such Microsoft WWA Host "C:\windows\system32\wwahost.exe" has to be allowed in the firewall as TCP via 443 to MS servers.
Now I can login via Microsoft Authenticator, not sure if it works if PIN is removed, I will test it once the new BIOS/TPM arrives.

Dru2 said:

There's always going to be exceptions to the rule that no one saw coming. That's life whether you're a doctor, or PC programmer. I'm simply speaking on the "generally speaking" of owning a PC... it's an active endeavor, not a passive one. If you own a PC take a minute to figure out the stuff you use. Don't do things you're not comfortable with unless you have some basics for getting yourself out of trouble.

No one on the planet can cover all the what ifs and maybe so's, but some basics go a long way in helping you out a jam. I always remember my boot camp instructor saying when you're in trouble "remember your training". Doesn't mean its always going to work, but it goes a long way in giving you a chance. This is the attitude I bring to anything I do, including using PCs. That's me.

I don't have the answers to all the issues I run into / may run into, but I'm confident I can figure it out because have some basic knowledge on the stuff I use. And yes, forums help as well.

My two cents.

Click to expand...

In that context, yeah, I wholeheartedly agree - and I've promoted this before and still do - too many users have computers and don't even know the basics of computer maintenance.

But even with that this issue definitely edge-case worthy. It's very specific, and probably is dependent upon numerous variables, not just the OS itself.