Windows 10: Organization changing Windows Hello PIN settings

I have been signing on to my laptop running Windows 10 with a PIN for a year, but after I installed Microsoft Office through my university, it forced me to change my PIN to something overly complex, saying my organization required it. Now when I try to change/re-enable my PIN, it says Windows Hello is unavailable. I suspect it has something to do with the fact that when I installed Office through my university, it asked me if I would allow my organization to change settings on my device, and I allowed it. I want to undo this, because it's driving me crazy, but can't figure out how. I've already tried disabling 'Use Windows Hello For Business' in the local group policy editor, which doesn't seem to have done anything at all. How can I revoke an organization's control over my laptop's settings?

:)

 

Login with PIN and Hello

Hi Jean,

Windows 10 includes multiple options to sign-in to your account, including the ability to sign-in using a PIN and Windows Hello, which uses facial recognition. For us to provide a solution suited to your concern, we need additional information. Can
you answer the questions below?

• How are you setting the PIN and Hello?
• Which build version of Windows is your PC running on?
• Were there any error codes or messages?

In the meantime, we suggest that you follow the steps below on how to set up PIN.

• Open Settings.
• Select Accounts.
• Click Sign-in options.
• Click the Add button for the PIN and set your PIN.
• Do the same for the Windows Hello.

Looking forward to your response.

 

Can't enable Windows Hello - Some settings are managed by your organization

I found the solution. The reason is that Windows Hello is managed differently on domain joined computers, starting with the anniversary update.
To get it to work you have to follow these steps:

1) Setup a Group Policy Central Store (you should already have that)

2) Get Windows 10 Anniversary Update Group Policy Templates. You can do so by copying your files from PolicyDefinitions (in windir on a Win10 Anniversary Update machine) into the PolicyDefinitions of the central store. You might copy those files first to a file share, because of permissions your regular user should not have on the central store.

3) Setup a new GPO or add to an existing the following settings to enable Windows Hello:

• Computer Configuration/Policies/Administrative Templates
  

.../Windows Components/Windows Hello For Business/ Use biometrics => Enabled

.../Windows Components/Windows Hello for Business/ Use a hardware security device => Enabled (if you want to use TPM instead of key or certificate based activation for Windows Hello). Note that in general all business computers should have TPM

.../System/Logon/ Turn on convenience PIN sign-in => Enabled (This is the key. This enables PIN sign-in which in turn will enable Hello, together with the other settings.)

.../Windows Components/Biometrics/ Allow domain users to log on using biometrics => Enabled (I think this is enabled by default, but being explicit makes GP management a lot easier.)

You will find more optional configuration possibilities in System/Logon and Windows Components/Biometrics and Windows Components/Windows Hello for Business.

You will find more background here:
Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

and here

Manage Windows Hello in your organization (Windows 10) - Microsoft 365 Security | Microsoft Docs

Most important excerpt:

If you want to use key or certificate based Windows Hello you can follow the guides in the links. Don't get confused though. You can still use regular TPM for normal Windows Hello.

 

windows hello and pin

Hi,

This error code is usually caused by corrupted Windows system files. For better assistance, we would like to ask the following:

• What happens when you're trying to set up Windows Hello or a pin on your computer?
• Is there an error message displayed when setting up Windows Hello or a pin?
• What troubleshooting steps have you done so far?
• How did you reinstall Windows?

Looking forward to your reply so we can provide the best resolution for you.