Windows 10: Windows Hello for Business - PIN reset - methods to verify the user

With the WHFB deployment in an enterprise environment trying to move to password lessIn the PIN reset flow from locked machine, user forgot PIN Scenario while the user tries to reset the PIN by select "Forgot PIN" option, the user is asked to verify themselves with Password.Question is is there any configuration option anywhere to remove the password as user verification method and add other methods like MS authenticator or FIDO based authentication methods.Thanks in advance--Balaji

:)

 

How to deactivate asking for Windows Microsoft Hello Pin

Hi

Welcome to Microsoft community.

To deactivate the prompt for creating a Windows Hello PIN on Windows 10, you can follow these steps:

Method 1: Disable Windows Hello PIN Requirement

1. Open Settings.
   
2. Navigate to Accounts:
   
   • Go to Accounts > Sign-in options.
     
3. Disable Windows Hello PIN:
   
   • Under Manage how you sign in to your device, you will see options for Windows Hello PIN, Face, and Fingerprint. Find the Windows Hello PIN section.
     
   • Click on Windows Hello PIN and then click Remove.
     
   • Confirm the removal by following the prompts.
     

Method 2: Use Group Policy Editor (for Windows 10 Pro, Enterprise, and Education)

1. Open Group Policy Editor:
   
   • Press Win + R, type gpedit.msc and press Enter.
     
2. Navigate to Windows Hello for Business:
   
   • Go to Computer Configuration > Administrative Templates > System > Logon.
     
3. Disable Windows Hello for Business:
   
   • Find the policy named "Turn on convenience PIN sign-in" and double-click it.
     
   • Set it to Disabled.
     
   • Click Apply and then OK.
     

Method 3: Use Registry Editor (for all versions of Windows 10)

1. Open Registry Editor:
   
   • Press Win + R, type regedit, and press Enter.
     
2. Navigate to the Key:
   
   • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
     
3. Create or Modify the Value:
   
   • Right-click on the right pane, select New > DWORD (32-bit) Value.
     
   • Name it "AllowDomainPINLogon" and set its value to 0.
     
4. Restart Your Computer:
   
   • Close the Registry Editor and restart your computer for the changes to take effect.
     

Disclaimer: Generally, modifying registry subkeys or work group is intended for advanced users, administrators, and IT Professionals. It can help fix some problems, however, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For further protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click How to back up and restore the registry in Windows - Microsoft Support to view the article.

Additional Steps if Needed

• Sign in with Local Account:
  
  • If the above methods do not work, consider switching to a local account instead of a Microsoft account.
    
  • Go to Settings > Accounts > Your info.
    
  • Click on Sign in with a local account instead and follow the prompts.
    
• Troubleshoot Sign-in Issues:
  
  • Ensure that your system is up to date with the latest Windows updates.
    
  • Sometimes, a corrupted user profile can cause issues. Creating a new user profile might resolve the problem.
    

If you need further assistance, feel free to reach out.

Best regards

Derrick Qian | Microsoft Community Support Specialist

 

Login with PIN and Hello

Hi Jean,

Windows 10 includes multiple options to sign-in to your account, including the ability to sign-in using a PIN and Windows Hello, which uses facial recognition. For us to provide a solution suited to your concern, we need additional information. Can
you answer the questions below?

• How are you setting the PIN and Hello?
• Which build version of Windows is your PC running on?
• Were there any error codes or messages?

In the meantime, we suggest that you follow the steps below on how to set up PIN.

• Open Settings.
• Select Accounts.
• Click Sign-in options.
• Click the Add button for the PIN and set your PIN.
• Do the same for the Windows Hello.

Looking forward to your response.

 

Windows Hello vs Hello for Business?

I’m sure for a consumer it’s impossible to setup Hello for Business since it’s dependent on a certificate based authentication vs using just the Hello which uses a convenience PIN, which is a bit less secure than Hello for Business. And plus, Hello for Business requirements are that a pc needs to be joined to Azure AD which a home user account cannot accomplish. Is it still good idea for a consumer like me on a Standalone pc to use just the convenience PIN to login to Windows?