22H2 Security Key Logon not working version 22621.819

mrs117 16

Hi -

I am currently aware of the issues with FIDO2 security logon after updating to Windows 11 22H2.

My machine is currently running build 22621.819 (just updated with KB5019980 11.14.2022).

Even after reinstalling windows, I am unable to logon with my FIDO2 security key. I am able to enter my PIN... the key does not recognize my touch input. If I raise my laptop lid slightly after touching the key, I am able to log on. Firmware, etc on my computer and dock are up to date. This issue only began affecting me after my machine updated to 22H2 on 10.5.2022. I am able to log on with my password. I am able to use my security key when prompted via WebAuth.

I have also tried forcing an install of the remediation update (KB5017389), but my computer tells me it is not able to/not applicable on my machine.

Please advise...

mrs117 16 Reputation points

2022-11-15T19:06:50.09+00:00

I have completed a full factory reset of my machine and this issue still persists...
MicrosoftWilton 16 Reputation points

2022-12-15T15:14:33.127+00:00

Experiencing the same issue and have support tickets open with both Yubico and Microsoft on it. First noticed it back in August/September but now appears to be more systemic. With random machines in my fleet exhibiting the behavior and others not.
You're the only other person I've been able to find raising this issue. (Found your post here on it: https://answers.microsoft.com/en-us/windows/forum/all/windows-11-22h2-fido2-security-key-logon-not/f23dcb43-93f3-4757-8ccd-ddc098dbcf70)
What kills me is in reviewing the logs here: %SystemRoot%\System32\winevt\Logs\Microsoft-Windows-WebAuthN%40Operational.evtx It appears that the affected devices successfully accept the authentication attempt with the FIDO key.
I'll be sure to follow up on this thread if I get anywhere with it.
mrs117 16 Reputation points

2022-12-15T16:00:44.057+00:00

This comment made my day, I thought I was going crazy on a lonely island.

Yes, especially frustrating when there are no obvious errors in any logs, no failed logons...

Initially I thought it may have something to do with RMA or Direct Access memory... used InTune to bypass that/operate at the least restrictive settings. No change. My next lead is some sort of Bitlocker configuration... which would not be ideal - clinical setting! Both my domain controllers are ready for Netlogon/Kerberos Hardening as explained here: https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#2952

I've also attempted using Windows Known Issue Rollback but it either is not applicable to my machine or it just doesn't work as I'm expecting.

Thankfully, this issue has only affected my workstation and one other. I asked my sysadmin to block 22h2 from deploying within 15 minutes of performing the upgrade on my machine!

Thanks for the reply. I will add notes, too, if I do stumble upon some sort of resolution. :) Oh, P.S., are you able to use the laptop-lid-lift trick, too?
MicrosoftWilton 16 Reputation points

2022-12-15T16:25:25.717+00:00

YES! As far as the lid thing goes, I'm finding that I'm able to reproduce that behavior on most of my fleet, and also explains why I was seeing the behavior on some machines and not others. (The ones not having the problem are people who keep their laptop lids open when docked.)

The lid behavior has sent me down a rabbit hole of more google-fu.
The rabbit hole starts here: https://www.dell.com/community/XPS/Windows-Hello-with-lid-closed/td-p/7415687
Since FIDO keys are part of Microsoft's Windows Hello implementation some of the caveats/limitations described here seem to apply: https://learn.microsoft.com/en-us/windows-hardware/customize/power-settings/power-controls-lidnotificationsarereliable

I've tried making the registry change described in the Dell article to see if it'd have any effect but unfortunately it seems the key reverts after reboot and haven't been able to dig further yet, but at this moment I'm thinking that Power/Lid Control options is where the problem lies.

This eerily echoes the Modern Standby issues to me...
MicrosoftWilton 16 Reputation points

2022-12-16T18:14:57.237+00:00

Got something to try @mrs117 .

I've tested this on a few machines in my fleet with promising results. I was making a mistake yesterday by messing with a similarly named key "LidReliabilityState".

As that Dell article suggests.

Create or Modify the following Registry Key:
HKLM\SYSTEM\CurrentControlSet\Control\Power\ REG_DWORD "LidNotifyReliable" value 0

On the machines I've tested with there haven't been any adverse effects noticed, external Windows Hello cameras and such still appear to work as expected when docked, but it does seem to solve the FIDO key issue!
mrs117 16 Reputation points

2022-12-16T18:40:59.637+00:00

Cool! Thanks for the idea :)

I'm ooo all next week so it's been pushed to the back of my mind. Will give this a try soon!
mrs117 16 Reputation points

2022-12-27T18:07:27.883+00:00

Hi again -

Wanted to update you... your reg edit worked! Awesome! Thank you so much!

1 answer

Mike Crawford 6 Reputation points

2023-03-13T14:35:19.5766667+00:00

I too was seeing this issue after adding a Dell D3100 dock to my setup. Took me a while to realise that the lid being open or closed was the key ('scuse the pun) to it all.

Found a post on a Dell forum recommending LidNotifyReliable ( https://www.dell.com/community/XPS/Windows-Hello-with-lid-closed/td-p/7415687 ) and that key led me here.

Added the reg setting and Yubikey now works fine. No reboot required.
Please sign in to rate this answer.
mrs117 16 Reputation points

2023-03-13T16:02:34.1033333+00:00

Glad you stumbled upon this post :) Thanks for sharing! This fix has not resulted in any odd behavior, and have used it on ~20 machines now!
Sign in to comment

Share via

22H2 Security Key Logon not working version 22621.819

1 answer