Windows 10: Asked to change PIN Windows Hello managed by organization, they said to use "certUtil...

Hello, I am part of a business organization and I have a win 11 setup with a PINFor security reasons I had to change my PIN Windows Hello that is managed by my organization.I contacted one of the IT managers of the company that suggested to run a CMD command as admin with the promise that re-booting after that I should have the possibility to setup a new PIN.This is the command they said to perform:certUtil.exe -deleteHelloContainerI did it:But when I reboot-ed I only had to insert my company password and no ways to create a new Hello Windows PIN.If I go under settings I still see my PIN Set

:)

 

Organization changing Windows Hello PIN settings

I have been signing on to my laptop (running Windows 10) with a PIN for a year, but after I installed Microsoft Office through my university, it forced me to change my PIN to something overly complex, saying my organization required it. Now when I try
to change/re-enable my PIN, it says Windows Hello is unavailable. I suspect it has something to do with the fact that when I installed Office through my university, it asked me if I would allow my organization to change settings on my device, and I allowed
it. I want to undo this, because it's driving me crazy, but can't figure out how. I've already tried disabling 'Use Windows Hello For Business' in the local group policy editor, which doesn't seem to have done anything at all. How can I revoke an organization's
control over my laptop's settings?

 

Minecraft Xbox Asks for Hello Pin

Hello Bob,

I am Jaspreet Singh.

Please try out the steps listed by Mr Prakhar_Khare here : https://answers.microsoft.com/en-us/windows/for...

 

Can't enable Windows Hello - Some settings are managed by your organization

I found the solution. The reason is that Windows Hello is managed differently on domain joined computers, starting with the anniversary update.
To get it to work you have to follow these steps:

1) Setup a Group Policy Central Store (you should already have that)

2) Get Windows 10 Anniversary Update Group Policy Templates. You can do so by copying your files from PolicyDefinitions (in windir on a Win10 Anniversary Update machine) into the PolicyDefinitions of the central store. You might copy those files first to a file share, because of permissions your regular user should not have on the central store.

3) Setup a new GPO or add to an existing the following settings to enable Windows Hello:

• Computer Configuration/Policies/Administrative Templates
  

.../Windows Components/Windows Hello For Business/ Use biometrics => Enabled

.../Windows Components/Windows Hello for Business/ Use a hardware security device => Enabled (if you want to use TPM instead of key or certificate based activation for Windows Hello). Note that in general all business computers should have TPM

.../System/Logon/ Turn on convenience PIN sign-in => Enabled (This is the key. This enables PIN sign-in which in turn will enable Hello, together with the other settings.)

.../Windows Components/Biometrics/ Allow domain users to log on using biometrics => Enabled (I think this is enabled by default, but being explicit makes GP management a lot easier.)

You will find more optional configuration possibilities in System/Logon and Windows Components/Biometrics and Windows Components/Windows Hello for Business.

You will find more background here:
Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

and here

Manage Windows Hello in your organization - Windows Security | Microsoft Learn

Most important excerpt:

If you want to use key or certificate based Windows Hello you can follow the guides in the links. Don't get confused though. You can still use regular TPM for normal Windows Hello.