Windows Hello problem

Question

I have multiple reports from users that Windows hello functions (Pin, Fingerprint, face recognition) no longer work after we perform a name change to their AD accounts on our network. We try completely removing/rebuilding profiles (Both noninvasive and invasive), resetting authenticator (Login attempts are successful and you can reset a pin or fingerprint, but it won't work after), windows biometrics reset, and running services restart. All of the PCs are now after updates on windows 11 23h2, HP elite books and the issue persists from windows 10. Is this a known issue from Microsoft or is this something we can get corrected to stop from happening now after every name change, we perform from user requests?

***Move from Windows / Windows 11 / Accounts, profiles, and login ***

Answer 1

Hello

Thank you for posting on the Microsoft Community.

The Windows Hello issues you're experiencing, including PIN, fingerprint, and facial recognition not working properly, occur after an AD account name change, usually due to a mismatch or invalidation of user-specific data stored by Windows Hello, such as PIN, fingerprint, and facial recognition, with the changed account name. This problem is not only happening on Windows 10 but also in Windows 11 23H2 versions.

Windows Hello credentials, such as PIN, fingerprint, and facial recognition, are closely related to local user profiles. When an Active Directory (AD) account name changes, these credentials, especially local PINs and biometric data, are still tied to the old username or user profile. Because these credentials are associated with the account name, they prevent authentication with Windows Hello working.

Even through methods such as Delete and Rebuild User Profile or Reset Windows Hello Configuration, you find that the problem persists, mainly because the local profile and Windows Hello data are not cleared in time.

I hope the above information is helpful to you.

Regards

Runjie Zhai

Answer 2

That is not very helpful. HOW DO WE FIX THIS PLEASE?

Answer 3

Hello,

So, I just got a resolution for this today for us, we used

"certutil.exe -DeleteHelloContainer"

run that as CMD for the user

Was a CA authority issue for us.