Solved Your opinion on the 'Can of Worms' that is TPM

Dru2 · Dec 19, 2021

glasskuter said:
That statement is absolutely correct if everything is working correctly. BUT according to posts I have read from users across the web it doesn't always happen the way it is supposed to. They never see an option to enter a password. Whether it is an issue with Windows or from whatever reason the TPM gets hosed up (bios update, whatever), the flow of the login process is affected. If the issue in on the Windows side, maybe our backups would save us. But if the issue is on the TPM side, backups are useless.

There are enough instances reported that this should be a concern for everyone. If it works as expected ALL the time, I wouldn't be concerned. But it's a computer and as we say here in Texas, things don't always run according to Hoyle.

Correct, I never got a "password" option, however simply creating a pin allowed me back into the OS. And a backup does no good if you can't log into Windows :wink:

Anyway, I think this whole "being locked out of Windows" is a bit overblown. As one who just went through and documented this TPM/BIOS change issue, I can tell you even though the BIOS change caused me to have to create a new pin, I was never in danger of being locked out of Windows.

Here's my deal - I was using Windows Hello face recognition to sign into my PC. But after doing a BIOS update, I got this screen telling me I needed to create a new pin as the old one was removed....

I simply created a 4-digit pin, and I was able to log into Windows without issue. In my case here, and perhaps because I was using Windows Hello face recognition, I never got an option to use my "Microsoft account" so I was basically "forced" to setup a pin first. After that (logging out and back in) I was able to get the "password" option.

Regardless, I was NEVER in danger of being locked out, since all I had to do was simply create a new pin :wink:

My Issues:

BIOS update - Updated BIOS - now can't log in to windows??
My Windows Pin/Hello issue - Windows Hello pin issue?

Fabler2 · Dec 19, 2021

Winuser said:
I found a setting in Accounts > Sign-in options to only use Windows Hello to sign-in for Microsoft Accounts on this device. I don't know if turning this option on prevents someone to using their password when logging in or not.

Yes that works

I just turned it off.

Wynona · Dec 19, 2021

Here is a link to a pretty good (in my opinion) discussion of TPM.

Manage TPM lockout (Windows) - Windows security

Dru2 · Dec 19, 2021

Wynona said:
Here is a link to a pretty good (in my opinion) discussion of TPM.

Manage TPM lockout (Windows) - Windows security

Yeah, that gives us a how TPM lockout works, but provides nothing about potential sign in issues after a BIOS update.

hsehestedt · Dec 19, 2021

Dru2 said:
And a backup does no good if you can't log into Windows

Sure it does. You can reinstall Windows and recover all of your data from the backup. I would not say that the ability to recover all of your data "does no good". You can also directly boot from your backup.

Wynona · Dec 19, 2021

Dru2 said:
Yeah, that gives us a how TPM lockout works, but provides nothing about potential sign in issues after a BIOS update.

I didn't read it all the way through. I did note that there seem to be several ways to recover from a lockout.

I've searched and cannot find anything relating to BIOS and TPM later than one year ago and another one from 2018. The worst thing I can find is that TPM can't be found after a BIOS update.

glasskuter · Dec 19, 2021

I'm not too concerned about a brute force attack cracking my 15 digit MS password. (supposedly would take one hundred million years)

Turned OFF For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device
Removed Windows Hello sign-in option in settings
Made a little change in regedit as per @Edwin so I wouldn't be nagged to set up a pin every time I logged in with my Microsoft account
(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Settings\AllowSignInOptions > Value=0)
Note: value=1 you get the nag Value=0 you do not get the nag

Now, I can either enter my password or netplwiz it back in for auto logon if I get tired of entering it.
The only nag I now get is shown here, but when I enter my password, I'm taken straight to Windows without going to "Set up a pin" screen, and I can live with that.

z

My concern is solved....at least for me. One more possibly/maybe/supposedly can never happen future crisis averted. One more bit of personal control over my computer=priceless

Winuser · Dec 19, 2021

Dru2 said:
Correct, I never got a "password" option, however simply creating a pin allowed me back into the OS. And a backup does no good if you can't log into Windows

Anyway, I think this whole "being locked out of Windows" is a bit overblown. As one who just went through and documented this TPM/BIOS change issue, I can tell you even though the BIOS change caused me to have to create a new pin, I was never in danger of being locked out of Windows.

Here's my deal - I was using Windows Hello face recognition to sign into my PC. But after doing a BIOS update, I got this screen telling me I needed to create a new pin as the old one was removed....

View attachment 16587
I simply created a 4-digit pin, and I was able to log into Windows without issue. In my case here, and perhaps because I was using Windows Hello face recognition, I never got an option to use my "Microsoft account" so I was basically "forced" to setup a pin first. After that (logging out and back in) I was able to get the "password" option.

Regardless, I was NEVER in danger of being locked out, since all I had to do was simply create a new pin

My Issues:

BIOS update - Updated BIOS - now can't log in to windows??

My Windows Pin/Hello issue - Windows Hello pin issue?

When you clicked on either one of the boxes under Sign-in options did anything happen?

Dru2 · Dec 19, 2021

Wynona said:
I didn't read it all the way through. I did note that there seem to be several ways to recover from a lockout.

I've searched and cannot find anything relating to BIOS and TPM later than one year ago and another one from 2018. The worst thing I can find is that TPM can't be found after a BIOS update.

Understand the thread is about BIOS updates and TPM where sign ins could be an issue (Windows Hello).

In my issue, I'd done a BIOS update, and after logging into Windows was greeted by a screen (post #41) informing me my pin was no longer available and that I needed to create a new pin. I don't remember there being a password option, but just created the pin and was immediately logged into Windows. I should mention that I was/am using Windows Hello facial feature to log into Windows.

Anyway, I think @glasskuter's point is that a BIOS change could (it did for me) trigger the TPM to cause Windows Hello issues or confusion amongst some users. From that perspective, is TPM a can of worms.

Dru2 · Dec 19, 2021

Winuser said:
When you clicked on either one of the boxes under Sign-in options did anything happen?

Yes, but I honestly don't remember all the options. The "happy face" gave me the option to sign in with a school or business account. The Pin box gave me the option to create a pin or (here's where memory get fuzzy) or use a MS account password. Using the password worked, but once I logged out and back in, I still got that PIN screen, so I had to create a pin.

That said... I suspect my "pin" issue was also caused by an odd issue I got under "Accounts - Sign-in options" after my BIOS update. Also note my suspicion in post #16 of that thread.

Winuser · Dec 19, 2021

@Dru2, this is the option I get when I click on Sign-in options.

Dru2 · Dec 19, 2021

Winuser said:
@Dru2, this is the option I get when I click on Sign-in options.

View attachment 16613

Yeah, that's the screen "you" got. I didn't "lose" my pin as explained in post #41 :wink:

tinmar49 · Jan 6, 2022

I have a different pin for each pc, and more than once there has been a glitch (changing processor and having to reset fTPM), which resulted in my having to log onto my Microsoft sccount to reset the pin. I reset using the same pin that that particular pc had to start with. I always use pins with both letters and numbers, but every time, I start off forgetting to check the box allowing that.

Zardoc · Jan 6, 2022

Dru2 said:
Anyway, I think @glasskuter's point is that a BIOS change could (it did for me) trigger the TPM to cause Windows Hello issues or confusion amongst some users. From that perspective, is TPM a can of worms.

That's how I saw it also from reading the posts.

Electronics can get funky sometimes. I not going to knock TPM but if I don't need it, I don't use it unless unfortunately it's imposed like Windows Hello.

I for one hate having to ad a bunch of password questions when creating a user account so I start without a password on sign in and just add a reg command.

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"NoLocalPasswordResetQuestions"=dword:00000001

Zardoc · Jan 6, 2022

I don't have the option @Winuser has

Winuser · Jan 6, 2022

@Zardoc, did you set up a pin or just using a password to sign in?

Zardoc · Jan 6, 2022

Winuser said:
@Zardoc, did you set up a pin or just using a password to sign in?

@Winuser, Yeah I do have a pin.

I just followed through with what I said so went back and tried again. So the difference was, you click on the have no pin and the MS account login appears. There you can use your account password. I imagine it's the same thing if you install without an account. It should ask for the password because If I remember correctly, you can't use a pin without having a password but I may be wrong because I never tried to setup a pin without a password.

Winuser · Jan 6, 2022

Zardoc said:
@Winuser, Yeah I do have a pin.

I just followed through with what I said so went back and tried again. So the difference was, you click on the have no pin and the MS account login appears. There you can use your account password. I imagine it's the same thing if you install without an account. It should ask for the password because If I remember correctly, you can't use a pin without having a password but I may be wrong because I never tried to setup a pin without a password.

I think to setup a pin you have to sign into your MS account and have TPM turned on in the BIOS because it's a part Windows Hello. If I'm right, you would need a password. I'm not sure if the option to bypass the sign in still works. I haven't done it in years.

Zardoc · Jan 6, 2022

In Win 10, you can create a user without an MS account and have a password with an added pin afterwards.
In Win 11 you can create a user without an MS account (need to remove internet during setup) but I haven't tried to create a pin yet with that tye of account but I think it will work. However, good luck getting all your apps from Win store without an MS account unless you install offline.

humbird · Jan 6, 2022

My laptop has a built in fingerprint reader. I also have a password and a pin set up in case something should go screwy with the fingerprint reader.I do use a MS account. The fingerprint reader does use windows hello. TPM and virtualization is on in my BIOS.