Windows 10: Domain policies resets my PIN

I have fresh installed PC connected to domain. In domain all Hello features seems to be enabled and functional tested on other PCs. On my PC, I can setup PIN and it works fine. But after 1-2 hours it resets and is gone. It seems that every global policy sync disables this. Checked folder C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc and after PIN is created, there is GUID folder with data. After a while, folder is removed and PIN is gone. I set up event logging and there is always record that LOCAL SERVICE NT AUTHORITY just deleted whole folder.But why? How to check w

:)

 

Question regarding Windows PIN & Domain

Hi, I have few questions for Microsoft employees regarding PINs in Windows.

• Why Windows PIN option is disabled in domain by default?
  
• Is it a good idea to enable PIN in domain? As I understand it's more secure than password as it's directly tied to hardware unlike passwords.
  
• Can I enable PIN for all users in domain from the server? Or do I need to do it manually for each user via group policy editor?
  

Thank you in advance.

 

Issue with PIN Policy

I had an issue where I added a new Microsoft account that has corporate/domain policies to my personal computer. When setting up Teams I mistakenly agreed to let the domain policies apply to my computer. Immediately settings changed and one of the things
that happened was I had to change my pin due to the policy change. I have since removed my device from the domain and confirmed with the domain admin that my device is not registered but I cannot change my PIN settings. When I go to look at the policies I
see this:





But when I go to change to my PIN back to what it was originally I get this:





I don't understand why this would be and can only assume that there are still some domain policies applying. Any suggestions on how to fix this would be appreciated.

 

UnattendedJoin error: failed to find the domain data (0x6e)

Thanks for the suggestion! I don't want to add a domain account, as this is a generic unattended install that will be used for all company machines. Do you think it's possible that the computer would join the domain if, instead of using UnattendedJoin in specialize, I used your steps but left out the specific account?

The other thing I was thinking was to use a generic account to allow the domain join during the specialize step. I added a machine password in the UnattendedJoin component, and instead of getting the error listed above, I got an authentication error, which makes me think I could probably do a secure join instead of the unsecure join.

Thoughts?