Windows 10: Windows Hello PINs

Has anyone found a successful balance of Windows Hello PINs in an enterprise environment?

As I understand it, the PIN (which can include letters so they're really passwords) is local to a single computer. When tied to the TPM hardware, it can be used for a form of 2FA, as something you have and something you know (or are, if biometrics are enabled). The combination uses asymmetric key encryption for server authentication.

However, you'd still need to have traditional Active Directory services with username and password. Best practice is that local accounts would be disabled, so your AD would need to add the device+PIN/bio combination as a key for logging in to that user's AD account. If you do so, that user's going to have a different key for every computer they've ever logged in to, and the user's going to have a different PIN for every computer.

Also, I don't believe there's a provision for resetting those local Hello PINs when users forget them. Forgetting would be entirely reasonable if, say, the user's walking into a computer lab they last visited five semesters ago.

Am I missing something with this? It might make sense for an individual consumer who, rather than having a local account with its own password, only uses a Microsoft account for their account, and then might have different PINs for 1-2 computers, but it seems inane in an enterprise.

submitted by /u/KafkaExploring
[link] [comments]

:)

 

Login with PIN and Hello

Hi Jean,

Windows 10 includes multiple options to sign-in to your account, including the ability to sign-in using a PIN and Windows Hello, which uses facial recognition. For us to provide a solution suited to your concern, we need additional information. Can
you answer the questions below?

• How are you setting the PIN and Hello?
• Which build version of Windows is your PC running on?
• Were there any error codes or messages?

In the meantime, we suggest that you follow the steps below on how to set up PIN.

• Open Settings.
• Select Accounts.
• Click Sign-in options.
• Click the Add button for the PIN and set your PIN.
• Do the same for the Windows Hello.

Looking forward to your response.

 

windows hello and pin

Hi,

This error code is usually caused by corrupted Windows system files. For better assistance, we would like to ask the following:

• What happens when you're trying to set up Windows Hello or a pin on your computer?
• Is there an error message displayed when setting up Windows Hello or a pin?
• What troubleshooting steps have you done so far?
• How did you reinstall Windows?

Looking forward to your reply so we can provide the best resolution for you.

 

Unable to setup Windows Hello, error: incorrect pin

Hello,

Thank you for writing to Microsoft Community Forums.

May I know the complete error code or error message that you are receiving when you try to setup Windows Hello?

Do you have any other user account on the computer?

If yes, does Windows Hello work on that account?

If Windows Hello is not setup on other account, please setup it up and check if it works so that we can narrow down the issue for you.

I suggest to remove the pin and setup a new pin on the child account and check if it works with Windows Hello.

Please follow the steps below to remove and re-add the PIN:

• Press Windows logo key + I to open Settings.
  
• Select Accounts.
  
• Click on Sign-in options.
  
• Under PIN, remove the pin. There will be prompt to enter password, enter the password and removed the PIN.
  
• After the pin is removed, please click on
  Add to setup pin for the account.
  
• After setting up a new PIN, try to set up Windows Hello.
  

Hope it helps.

Regards,

Noor Azam S

Microsoft Community – Moderator