Solved Windows Hello pin issue?

Windows 11 Pro RTM 21H2 (build 22000.376)

For those using Windows Hello (issue apples to Windows Hello), can you check to see if you have the option to change or remove a pin?

Not sure if this is something new to Windows 11, but I don't get an option to remove or even change my pin. For the Pin section I get "This option is currently available" Clicking the dropdown box, I get "Sorry this pin isn't working for you organization's resources. Tap or click here to fix"....



BTW, I also have the exact thing on my laptop running Windows 11 Dev, so I'm wondering if it's a "Windows 11 Hello thing?

Just curious to see if anyone has the same and whether they have an option to remove or change the pin?

Thanks.

I use auto logon with netplwiz and use a password which I changed to from a pin. I still use the pin as well if I log out and log in again. hope this helps

I have the option on the latest Windows 11. I also have a password set up.

I have the same options as @CatnipTea and also have a password set up.

Yeah, Pro and .376 here. I have the options available. But I also do not have facial recognition enabled and I have a password and only use Hello disabled . I thought you had to have a password in order to use a PIN with Hello.

Often I got PIN errors if my account couldn't be logged into.

EDIT: I enabled only use hello and still see the options.

Yeah, I have password set up as well. Oddly enough when I go the fix the issue, I get this...



This makes it sound like I'm attached to an organization which of course I'm not. And I only have a "personal" account on this PC. I think my BIOS update I did yesterday hosed my system something. Interestingly enough, when I went to use my school account to login I got this...



However, there's nothing wrong with my TPM, and there are no error issues anywhere saying so other than this. And TPM (PTT) is enabled in the BIOS. Anyway, as a last resort, I cleared the keys. Something not really recommended. Next step now is an OS reinstall

geneo said:

But I also do not have facial recognition enabled and I have a password and only use Hello disabled . I thought you had to have a password in order to use a PIN with Hello.

Click to expand...

Yeah, I do have a password and has used it trying to figure my issue out. Even turned off biometrics (fingerprint / facial) and still don't any pin options

Oddly enough the pin I did setup works without issue. And it's also what I use to log into Windows. I simply get no remove or change pin options under Accounts > Sign-in options

Maybe in BIOS your keysets for secure boot have not been set. Under the secure boot settting.

geneo said:

Maybe in BIOS your keysets for secure boot have not been set. Under the secure boot settting.

Click to expand...

Thanks Geneo, yeah, I checked those too. This seems to be one of those weird cases where a rare BIOS comes along and creates a rare issue.

Looks like I'll be proceeding with a clean install. Already created the install media.

Thanks.

Issue resolved...



All it took was a clean reinstall. And I wanted a clean install so to start fresh from the BIOS update

@Dru2 Would you mind posting your thoughts to a post I made about my concerns on this same issue HERE. Folks don't believe that bios updates sometime mess with TPM and Windows Hello. Another user had a similar issue with a bios update HERE
Thanks.

Finally, fully up and running again. The time-consuming part is installing all the apps, programs, and appropriate drivers. GTG now :)

@glasskuter,

glasskuter said:

@Dru2 Would you mind posting your thoughts to a post I made about my concerns on this same issue HERE. Folks don't believe that bios updates sometime mess with TPM and Windows Hello. Another user had a similar issue with a bios update HERE
Thanks.

Click to expand...

Yes, despite my initial post saying this couldn't happen, it appears Windows Hello can be upset by a BIOS update

That said, if you're just using a Microsoft account password to log into Windows, which is what I normally did, a BIOS update shouldn't upset that because the password isn't stored in the TPM as the PIN and other biometric (face, fingerprint) info is.

Still don't remember seeing this issue under Windows 10, where I also had a pin setup, so I'm not a bit confused; and why I was so adamant it couldn't happen. This experience with a BIOS update under Windows 11 with its TMP requirements, showed me it can happen

With that. there's still some stuff I need to research, but that's for a later date.

Questions?

Dru2 said:

it can happen

Click to expand...

That's why I call it a can of worms just waiting to happen

glasskuter said:

@Dru2 Would you mind posting your thoughts to a post I made about my concerns on this same issue HERE. Folks don't believe that bios updates sometime mess with TPM and Windows Hello. Another user had a similar issue with a bios update HERE
Thanks.

Click to expand...

This should only happen if you are using a firmware TPM. If you add a physical TPM module to your system, this won't happen. Personally, I always add a physical TPM even on systems where a firmware TPM is already available.

hsehestedt said:

This should only happen if you are using a firmware TPM. If you add a physical TPM module to your system, this won't happen. Personally, I always add a physical TPM even on systems where a firmware TPM is already available.

Click to expand...

Guess operative is "should". Firmware TPM is not in the BIOS, it is on the chipset in the Intel Management Engine (IME aka CSME) firmware. However, some BIOS updates bundle in an IME firmware update (they can be done independently). It would interesting to know if these BIOS updates with issues included an IME firmware, and potentially TPM, update.

hsehestedt said:

This should only happen if you are using a firmware TPM. If you add a physical TPM module to your system, this won't happen. Personally, I always add a physical TPM even on systems where a firmware TPM is already available.

Click to expand...

I am (was) using firmware TPM. Been running it before Windows 11.

Anyway, may I ask why a physical module? Do you have specific needs?

geneo said:

Guess operative is "should". Firmware TPM is not in the BIOS, it is on the chipset in the Intel Management Engine (IME aka CSME) firmware. However, some BIOS updates bundle in an IME firmware update (they can be done independently). It would interesting to know if these BIOS updates with issues included an IME firmware, and potentially TPM, update.

Click to expand...

That sounds plausible to me, and my BIOS update did say it addressed "major vulnerabilities". I posted the BIOS notes here.

Anyway, I've been thinking about my ordeal and can't help but wonder if my connection to my school's O-365 Office suite was also partly to blame for my pin issue. I noticed all my PC's running Windows 11, using a pin to log in, and also attached to my school's Office account have the same issue... no Pin options. Hmm....

glasskuter said:

That's why I call it a can of worms just waiting to happen

Click to expand...

Yeah, but I seriously can't help but think there may be more to it. But, yes, all evidence points to a BIOS update

Dru2 said:

Anyway, may I ask why a physical module? Do you have specific needs?

Click to expand...

I was already aware of the issues with FW TPM often getting reset with BIOS updates and I just wanted greater reliability because I use my systems for a lot of experimentation and perform frequent changes in the BIOS including complete erase of the CMOS data.

hsehestedt said:

I was already aware of the issues with FW TPM often getting reset with BIOS updates and I just wanted greater reliability because I use my systems for a lot of experimentation and perform frequent changes in the BIOS including complete erase of the CMOS data.

Click to expand...

And unplugging the TPM from the board doesn't reset things?

Anyway, I did (do) have a physical TPM module I bought for one of my Gigabyte boards in 2017, but I found the module caused performance issues, so I no longer have it installed; And especially since my boards (including the one I bought the module for) support firmware TPM.

At the end of the day, I now know this could be an issue, so I'll adjust for it moving forward as I'm not going to stop doing BIOS updates as they release. That's me.

hsehestedt said:

This should only happen if you are using a firmware TPM.

Click to expand...

And that's what the majority of users are using. (ME too) Joe-Blow user doesn't even know the difference. So, guys, I'm like a bulldog when I come up against something like this and want a plan going forward. Like @Dru2 I'm not going to stop doing bios updates, so what exactly would be our options here for protecting ourselves from getting caught in this trap? Is turning off pin the only way? Then we have to see the pin nag that won't go away even using group policy. (It's supposed to but doesn't stay gone permanently)