Using Windows Hello with local account (for authenticating into websites and apps)

Hello, first post here!

Hoping someone can help me with this... thanks!

I use a local account but I finally enabled Windows Hello with a PIN, to be able to use FIDO2 passkeys to authenticate to websites and apps. Since the PIN has only local significance, I just configured a small 4 digit PIN which I consider enough for my computer that never leaves my home.

I was expecting that for logging into Windows, I would still be prompted for my password (since I use a local account) . But instead, the login screen now defaults to the PIN that I configured for Windows Hello. Which I don't want to use for my initial login.

Is there any way to enable Windows Hello with PIN for authenticating into websites and apps, but not for the initial login?

In other words, can I disable the PIN option from the initial login screen?

Thanks!!

Gonzchi

Gonchisky said:

the login screen now defaults to the PIN that I configured for Windows Hello. Which I don't want to use for my initial login.

Click to expand...

Welcome to Eleven Forum.

Why do you not want to use the PIN to sign in? Anyway, if you want to use a password just click 'sign in options' below the PIN box.

Thank you for your reply.
Of course, if I want to use a password I can do it.

But that's not the question. The question is that I want to disable the possibility of using a PIN, so that nobody can log in my computer with my easy 4 digit PIN.

Thanks.

Gonchisky said:

The question is that I want to disable the possibility of using a PIN, so that nobody can log in my computer with my easy 4 digit PIN.

Click to expand...

If you have set a PIN I don't think you can avoid seeing the PIN option on the sign in screen.

The PIN is more secure than you may think. Brute force attempts to guess your pin will result in the PIN being locked out.

Hi Gonchisky, welcome to the ElevenForums

If you remove the PIN from your account, it will also remove any added face or fingerprint sign-in option from your account since a PIN is required for all Windows Hello sign-in options.

For security purposes, It doesn’t need to be a 4 digit PIN.
You could change the pin to include letters and numbers to make it more secure, and please note: The length of the pin can be 127 characters



Please refer to:

Bree said:

If you have set a PIN I don't think you can avoid seeing the PIN option on the sign in screen.

The PIN is more secure than you may think. Brute force attempts to guess your pin will result in the PIN being locked out.

Fix: You’ve entered an incorrect PIN too many times

If you're facing 'You've entered an incorrect PIN too many times; this post will be helpful, keep reading the article for more info.

www.kapilarya.com

Click to expand...

Yes, I think you are right. I looked everywhere, including Policy Editor and I could not find a way. Thanks. I assumed that since I'm using a local account it would still only use the password as the only login option, but I was wrong.

I don’t know of anyway to disable the pin for one thing and not another.

I would consider using 2 factor where possible on websites using Microsoft Authenticator for your PC or device. This would usually require a mobile phone.

Microsoft Authenticator (in my opinion) is a life save for me and a great app. Microsoft got it right I believe

antspants said:

For security purposes, It doesn’t need to be a 4 digit PIN.
You could change the pin to include letters and numbers to make it more secure, and please note: The length of the pin can be 127 characters

View attachment 94621

Please refer to:

Change PIN for Account in Windows 11

This tutorial will show you how to change the PIN for your account in Windows 11. Windows Hello is a more personal, more secure way to get instant access to your Windows 11 devices using a PIN, facial recognition, or fingerprint. You'll need to set up a PIN as part of setting up fingerprint or...

www.elevenforum.com

Click to expand...

Yes, thank you. I figured that the solution would be to make an alphanumeric PIN , I could even make it the same as my password.
Thanks so much.

Gonchisky said:

Thanks so much.

Click to expand...

No problem, welcome here

I'm learning the in & outs of Passkeys and saw this thread. At my point of ambiguity in all of this Passkey, Win Hello, etc, I'm a bit apprehensive to experiment on real accounts. So I'm trying to learn basic parameters from more experienced folks so I don't shoot myself before getting out the gate. I'd be much obliged to anyone so kind as to clear up my understanding on the below questions.

So when one has Windows Hello enabled to handle Passkeys it apparently also requires (on Hello creation) a Pin + Biometrics for either a MS Online account or a Local User (Laptop etc) account. I.e. one or the other, correct (?)

And if I enable Windows Hello for MS Online account then I can still get past the Local user account Lock screen with the standard old insecure windows user account Password, correct (?)

But in order to login to any online retail etc account with a Passkey I'd need to then be logged into my MS online account, correct (?) And that would make it a bit inconvenient since I don't usually like doing business while logged into MS online Account.

On the other hand if I enable Windows Hello instead on my Laptop's Local user Account then I will have to give the Windows Hello Pin or use Biometrics to get past the Lock screen. That makes the device very secure. But if one has need to take their laptop to a repair shop it would appear you'd have to give them your Passkey Pin. That doesn't seem like something one would do (?)

In summation I also see some folks (instead of using a Hardware key) use a Password Manager for storing Passkey credentials. However Passkey capable Password Managers store the Private Key (of the Passkey) in it's own database file (not the TPM or OS enclave). Now they could store TOTP and Passkeys in a seperate DB file with a different Password. But obviously comparison rabbit holes therein.

I went to A demonstration of the WebAuthn specification and tried the demo create but on Register it doesn't give me an option for my Laptop, only a hardware key or phone. I surmise this is because I don't have Windows Hello set on my Laptop yet?