Can't remove windows hello PIN

Question

Hello,

I can't remove the windows hello PIN on any of our company devices after it has been enrolled for more than a week. The option is greyed out in account settings and all I can do is change it. That is an issue if a user forgots his/hers PIN. No GPO that I have set should cause this behavior.

There is zero information on the settings page as to what is causing the PIN to be non-removable.

(Which makes solving the issue kind of frustrating.)

Kryštof Jelínek

Answer 1

Hello,

It seems like you are experiencing an issue with the Windows Hello PIN being non-removable on company devices after being enrolled for more than a week. There are a few potential reasons to consider:

Group Policy Settings: Double-check the Group Policy settings related to Windows Hello for Business and PIN policies. Verify that no policies are enforcing a minimum PIN length, complexity, or expiration that might prevent the PIN from being removed. Also, check if there are any policies that restrict the removal of the PIN after a certain period.

Intune or MDM Policies: If your organization uses Intune or another Mobile Device Management (MDM) solution, review the configuration profiles for Windows Hello and PIN policies. Ensure that the policies are not preventing the removal of the PIN and that there are no conflicts between the local Group Policy settings and the MDM policies.

Device Encryption: If the device is encrypted using BitLocker or a similar encryption solution, it may be preventing the removal of the PIN for security reasons. Check the encryption settings and consider temporarily suspending or decrypting the device to test if it allows PIN removal.

Windows Updates: It’s possible that a Windows update changed behavior related to Windows Hello PIN management. Check for any recent updates and consider rolling back to a previous version to see if the issue is resolved.

Device-Specific Issues: Certain hardware or firmware configurations can impact Windows Hello PIN management. Ensure that the devices are running the latest firmware and drivers, especially for security and biometric-related components.

Best Regards,

Hania Lian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

1. Open the Services Panel and Stop the biometric service:
   1. Press the Win + R keys together to open a Run dialog box.
   2. Type services.msc.
   3. Select Windows Biometric Service from the left-hand side column.
   4. Right-click it and select Stop from the list that appears.
2. Backup the old database:
   1. Open Windows Explorer.
   2. Go to C:\Windows\System32\WinBioDatabase.
   3. Copy and paste the .dat files into a new folder that you have created.
3. Delete the old database:
   1. Open Windows Explorer.
   2. Go to C:\Windows\System32\WinBioDatabase.
   3. Delete the .dat files.
4. Open the Services Panel and Start the biometric service:
   1. Press the Win + R keys together to open a Run dialog box.
   2. Type services.msc.
   3. Select Windows Biometric Service from the left-hand side column.
   4. Right-click it and select Start from the list that appears.
5. Register your Biometrics again:
   1. Go to Account Settings.
   2. At the Sign-in options, go through the registration process to re-register your biometrics.

Answer 3

Hello,

See if this video fix helps you:

https://www.youtube.com/watch?v=386HvYbW-KY

Let us know if this helps!