Cannot disable the windows hello. I am always asked for a PIN and not my password

Question

I am unable to install the BlueIris service on one of my win11 systems. The Microsoft email and password credentials I used to activate windows was rejected by the service install. I brought up netplwiz and made sure a checkbox was to require login (it was not). I also deleted the homeusergroup login whatever that was. This was a win10 to win11 upgrade. I tried a sign-out and a reboot, but I am always asked for a PIN and not a password. I disabled "only allow hello sign-in" but it is re-enabled ever time. The remove Hello button is grayed out. I ran the group edit policy and set "Turn on convenience PIN" to disabled. Rebooting I am still asked for the PIN and hello is till grayed out. If windows is not asking for my password, I cannot test my password to see if it is good. I assume the BlueIris service setup has the same problem. I have a local admin account and that asks for a password, but the service install wants my Microsoft credentials and will not accept the local account credentials. I have run SFC /SCANNOW and no problems show up.

Answer 1

Hi Joseph Stateson, 

Thanks for reaching out here in the Microsoft Q&A. I can understand the inconvenience this issue has caused you. Firstly, please answer the below question:

When installing other programs that require admin rights, do you encounter the same password/PIN issue, or is this unique to Blue Iris?

Scenario 1: If the problem is only with Blue Iris

Use the Built-in Administrator Account

1 - Open PowerShell as Admin: Win + X > Terminal (Admin) and run:

net user Administrator /active:yes

net user Administrator "YourStrongPassword"

2 - Log out and sign in as Administrator.

3 - Install/configure Blue Iris under this account.

4 - In Blue Iris Settings:

• Go to Settings > Startup > Check Run as a Windows service.
• Set service to log on as This account > Administrator.

Scenario 2: If other programs also have password/PIN issues

To help resolve this issue, please follow the steps outlined below:

Method 1: Force Remove Windows Hello via PowerShell (Admin)

Open PowerShell as Admin: Win + X > Terminal (Admin) and run these commands to wipe all Hello/PIN credentials:

# Remove all PINs for the current user Get-CimInstance -Namespace "MicrosoftWindowsHelloForBusiness" -ClassName "PinContainer" | Remove-CimInstance -Verbose
 
# Disable Hello for Business (if applicable) if (Get-Command -Name "Disable-WindowsHelloForBusiness" -ErrorAction SilentlyContinue) {     Disable-WindowsHelloForBusiness -Confirm:$false }

Reboot and check if the PIN prompt is gone.

 Method 2: Delete Credential Provider Cache

• Open Registry Editor as Admin.
• Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers
• Look for keys like {D6886603-9D2F-4EB2-B667-1971041FA96B} (Windows Hello) and export/backup them, then delete.
• Reboot.

Note: This method will reset Windows authentication components. Ensure you:

• Know your account password.
• Have administrator rights.
• Accept that some login methods may require re-setup. Proceed only if you understand these risks.

Method 3: Break Microsoft Account Linkage (For Local Auth)

1 - Create a New Local Admin Account

Run PowerShell as Admin: Win + X > Terminal (Admin).

Execute this to create a backup admin account:

# Create new local admin (do this FIRST as a backup) $Password = Read-Host "Enter NEW LOCAL ADMIN PASSWORD" -AsSecureString New-LocalUser -Name "LocalAdmin" -Password $Password -Description "Emergency Local Admin" Add-LocalGroupMember -Group "Administrators" -Member "LocalAdmin" Write-Host "New local admin 'LocalAdmin' created. KEEP THIS ACCOUNT SAFE."

2 - Check & Covert Microsoft-Linked Account

Run PowerShell as Admin: Win + X > Terminal (Admin):

# Open account settings to verify linkage Start-Process "ms-settings:yourinfo"

If it says Microsoft Account under your email, proceed to part 3.

3 - Convert to Local Account

Run PowerShell as Admin: Win + X > Terminal (Admin):

# Get current username (without domain) $CurrentUser = (Get-WmiObject Win32_ComputerSystem).UserName.Split('\')[1]
 
# Prompt for current Microsoft password (needed for conversion) $CurrentPassword = Read-Host "Enter CURRENT MICROSOFT PASSWORD" -AsSecureString
 
# Convert to local account (preserves files/settings) Set-LocalUser -Name $CurrentUser -Password $CurrentPassword Write-Host "Account '$CurrentUser' converted to local. Sign out to test."

4 - Verify & Cleanup

Sign out and log back in with

• Username: .$CurrentUser
• Password: The one you just set.

Method 4: Manual System File Check

If SFC didn’t help, scan deeper:

DISM /Online /Cleanup-Image /RestoreHealth

Then reboot and try SFC /scannow again.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have extra questions about this answer, please click Comment.

Best regards, 

Kim Nguyen - MSFT | Microsoft Q&A Support Specialist 

Answer 2

I had to create a new Microsoft account using a different email address. Once I got the account, I then used it to create an account on the PC that had a problem. The new account did not ask for a password which I thought strange. At the sign in I asked to reset the password as I actually had none. The reset request allowed me to create a password, and I used that password to install the Blue Iris app. [edit] I rebooted and did a logon using my original Microsoft credentials. The Blue Iris app is still running as a service so I can go back to using my normal login which only asks for a PIN.