WHFB Issue

Question

Had a handful of PC's lose the ability to Authenticate with their WHFB PIN code. I was able to delete the container, but am not able to login to the PC's with the cloud identity to re-create a PIN. The credentials are 100% correct, but I cannot sign back in with them. Ideas?

---

moved from Windows for home | Windows 10 | Windows Hello, lock screen and sign-in

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the detailed information.

Deleting the Windows Hello for Business (WHfB) container performs a destructive PIN reset, which removes the PIN and its associated credentials. After the container is deleted, the user should be able to authenticate with their account password and re-enroll a new PIN.

If the user is unable to sign in with their cloud identity despite using the correct password, the issue is typically related to device registration, authentication tokens, or WHfB provisioning rather than the PIN itself.

I would like to share the recommended troubleshooting steps include:

• Verify the device's Microsoft Entra join status using dsregcmd /status.
• Confirm that the device registration remains healthy and has not lost its Microsoft Entra join relationship.
• Use Sign-in options to select password authentication instead of PIN.
• Review the User Device Registration and Windows Hello for Business event logs for registration or provisioning errors.
• Validate TPM health (tpm.msc) and check for any TPM-related issues.
• If the device registration is unhealthy, re-registering or rejoining the device to Microsoft Entra ID may be required before WHfB can be reprovisioned.

Moreover, there is a known scenarios where Windows Hello for Business sign-in can fail because of key or device registration issues, which can prevent successful PIN reprovisioning until the underlying registration problem is resolved.

In short, once the WHfB container has been deleted, troubleshooting should focus on Microsoft Entra device registration, authentication token state, and TPM/device health, as these are common causes when both password sign-in and PIN re-enrollment fail.

For additional information, please visit:

PIN reset | Microsoft Learn

Windows Hello for Business known deployment issues | Microsoft Learn

If the information provided is helpful, please consider Accepting the Answer.

Thank you for choosing Microsoft Q&A!