‎A "Windows needs your current credentials" message appears‎ on FullCloud environment

Gaël POTIN 30

Hello,

We are on a Full Cloud environment with Windows Hello for Business enabled.

When logging in via PIN, we get a "Windows needs your current credentials" message that appears after a few seconds.

We've tried changing the PIN code + reboot and we've tried changing the "Always wait for network during session opening" policy to Enabled, but it doesn't change anything.

Our stations are managed by Intune

Thank you for your help :)

Ben Curtis 25 Reputation points

2023-10-02T20:18:17.36+00:00

I have this same issue for what it is worth. All devices that are AAD joined. Happens on unlock - not on first time login.
Eric Dyott 0 Reputation points

2023-11-07T22:05:41.98+00:00

Same issue here. Would like to find a fix since we are moving to all Cloud AAD joined systems moving FW.
Ben Curtis 25 Reputation points

2023-11-08T16:21:46.29+00:00

@Eric Dyott I ended up figuring this out on my environment. We are a hybrid environment. The PIN that is associated with the AAD account used, (and to onboard the machine to intune), only AAD knows it, not the local domain. If you lock the machine and unlock with password instead, it works fine. This is because ADConnect/EntraConnect syncs the password hashes from on-premise to AAD, but it does not sync PINS. Pins are a part of the AAD windows hello feature and there is additional setup required on your DC to be able to receive that syncing capability. I ended up just, on an as needed basis, using the password instead of pin.
Timothy Clark 0 Reputation points

2024-01-19T16:32:50.4166667+00:00

Any solution found at this point? We've the same issue. I'm trying to enable Windows Hello for Business but get the nag screen about credentials.
Oscar 0 Reputation points

2024-08-05T06:56:36.52+00:00

I found this query after not being able to get rid of the popup when working in the office, from home works fine and the solution for me was to simply login using password instead of PIN.

Thank you, Ben Curtis!

4 answers

Gaël POTIN 30 Reputation points

2023-08-23T07:21:46.0633333+00:00

Hey @Crystal-MSFT ,

Thank you for your reply, but unfortunately, as specified in my initial message, I have already tried all the steps described in the post, without success.

I have this problem just on Cloud users, not hybrids.
Please sign in to rate this answer.

2 people found this answer helpful.
Crystal-MSFT 47,611 Reputation points Microsoft Vendor

2023-08-24T01:59:11.29+00:00

@Gaël POTIN, Thanks for the reply. From your description, I know the above steps are already tried. But the issue still persists. Could you let us know if the issue is with all the Azure AD joined devices? Was any device can work without the message? If yes, is there any difference between the working devices and the not working one.

Gaël POTIN 30 Reputation points

2023-08-24T10:26:09.6266667+00:00

Not all computers are affected, the only difference being that the users affected had a Windows Hello PIN before we switched to the PasswordLess policy.

Crystal-MSFT 47,611 Reputation points Microsoft Vendor

2023-08-25T02:17:44.0366667+00:00

@Gaël POTIN, Thanks for the reply. Fo the affected devices, if we disable windows hello PIN, re-deploy the policy to the device, will it work?

Gaël POTIN 30 Reputation points

2023-08-25T08:15:03.67+00:00

The problem persists. It's interesting to note that it only appears when the workstation is unlocked, not when it is booted.

Crystal-MSFT 47,611 Reputation points Microsoft Vendor

2023-08-28T01:57:44.1066667+00:00

@Gaël POTIN, That's strange. I suggest open case to look into the issue.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Crystal-MSFT 47,611 Reputation points Microsoft Vendor

2023-08-23T01:31:25.4466667+00:00
@Gaël POTIN, Thanks for posting in Q&A. For your issue, based on my researching, I find it can be that the current PIN was created based on the previous password. You can try the following suggestions to see if it can work.

Change the PIN on one affected device to see if it works.

Clear saved credentials.

Disable “Always wait for the network at computer startup and logon.”

Update windows to latest version.

Here is a link with more details for your reference:

https://woshub.com/windows-needs-current-credentials/

Note: Non-Microsoft link, just for the reference.

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Kris Coady 0 Reputation points

2024-08-15T06:46:27.02+00:00

Same issue here on an AAD joined system. Doesn't seem to affect the functionality of my computer in any way. Tried the suggested steps but no luck.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Bram Maerevoet 0 Reputation points

2024-08-22T16:02:10.9966667+00:00

Hello, you need to allow the use of cloud trust for on prem authentication. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust?tabs=intune#configure-windows-hello-for-business-policy-settings

You can enable it in intune settings catalog > Windows hello for business.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

‎A "Windows needs your current credentials" message appears‎ on FullCloud environment

4 answers

Your answer