Changing Windows Hello PIN on EFS File Encryption and Access

Question

Microsoft accounts on Windows often do not have a password and only have a pin. This is recommended as only having Windows Hello sign-in improves security. When I encrypt my files using EFS, does it use my pin to encrypt the files? Would changing the pin lock me out of my files?

Answer 1

Hi Maldroid,

Thank you for reaching Microsoft Community. I understand that you have concerns about changing your Windows Hello PIN on EFS file encryption and access.

To answer your question, when you encrypt your files using EFS, it does not use your PIN to encrypt the files. EFS uses a combination of your user account password and a randomly generated file encryption key to encrypt your files. Therefore, changing your Windows Hello PIN will not affect your ability to access your encrypted files.

However, it is important to note that if you forget your user account password, you will not be able to access your encrypted files. Therefore, it is recommended that you create a password reset disk or USB drive to ensure that you can reset your password if needed.

To change your Windows Hello PIN, please follow these steps:

1. Open the Settings app by clicking on the Start menu and selecting the gear icon.
2. Click on Accounts.
3. Click on Sign-in options.
4. Under Windows Hello PIN, click on the Change button.
5. Follow the prompts to change your PIN.

I hope this information helps. If you have any further questions or concerns, please do not hesitate to ask.

Kind regards,
Marrion

Answer 2

If you set up a live Microsoft account on Windows during setup instead of a local account, you'll only need to create a PIN, and the password option is completely absent. What method does Windows employs to encrypt (EFS) my files in the absence of a password, and if I change my pin will it lock me out of my files?

Answer 3

Hi Maldroid,

Thank you for the response. Please note that setting up a Windows device with a Microsoft Account automatically uses the password for the Microsoft Account. Even if you were not asked to set up a password, there should still be an option to sign-in on the device using Password which would be the password of your Microsoft Account. With that said, EFS would use the said password.

However, just for you to be sure, I would recommend testing this first with one file encrypted with EFS then try to change your PIN and see if you are still able to access the file after the PIN change.

Kind regards,

Marrion