1

First I tried enabling PIN using Computer Configuration/Administrative Templates/System/Logon/Turn on convenience PIN sign-in.

This did allow me to set a PIN on the client PC (previously this option was greyed out). But after logging off, and even restarting, it kept asking for a password not PIN.

So, following the help provided on that setting:

"In Windows 10, convenience PIN was replaced with Windows Hello PIN, which has stronger security properties. To configure Windows Hello for Business, use the policies under Computer configuration\Administrative Templates\Windows Components\Windows Hello for Business.

If you enable this policy setting, a domain user can set up and sign in with a convenience PIN. "

So I went ahead and enabled Windows Hello for Business as well. After restarting client I still was not able to login with PIN, and on top of that the PIN setting within Settings was now greyed out. Under the Windows Hello section it states

"Windows Hello isn't available on this device"

This same device was connected at one point to Azure AD and it worked fine with a PIN so it seems the hardware is perfectly capable of using the PIN.

But I am now stuck as to what settings I need to change to enable to PIN for this local domain-joined device.

Using: Windows 10 Pro 14393.726 and Server 2016 14393.693

2

This isn't the answer you will be looking for, but to work around the statements made by the other two I figured I would add this in. I did a clean install of 1703 a week ago, joined my local AD domain, and noticed pin/sync were both greyed out and I was told I wasn't windows hello compatible. I spent about an hour googling and playing with things and at some point pin/sync worked again. (registry, GPO, and some edge sync settings surprisingly).

Last night, I had an issue in bash for windows which resulted in needing a clean install of 1703. I joined the domain and am right back where I was previously. I can't recall what exactly I did to resolve the issue, but I can tell you it's a problem with these newer releases of Windows 10. If I get mine working again, i'll come back and update this post.


I did just get PIN working. I went through and removed any domain gpo I had created relating to this issue. I manually ran gpedit.msc and set anything under windows hello for business to not configured, I then went to system/Logon and set 'use convenience pin' to enabled. I swear I did this earlier and it didn't work, but this time, my PIN button became available once I did so (no reboot/log required). While PIN is working, the machine does still tell me that windows hello isn't available (even though I have used the facial recognition login on this very machine in the past)

  • 1
    Just to confirm this is working. I had set up fingerprint on my 7677 for local account no problem, but domain login refused to budge. So as above - set all Windows Hello for Business to not configured and System -> Logon -> "use convenience pin" to enabled. It works now. Fun Fact - this login is set up to middle finger... In all honesty - I was thinking about Microsoft when did it, but clearly it was my subconsciousness which drew correct conclusions. – AcePL Mar 29 '18 at 8:22
1

It seems this feature may have become available in Windows 10 "Creators Update":

Windows Hello for Active Directory: Organizations that use an on-premises Active Directory will now be able to use Windows Hello to unlock their PCs, if they like.

See: https://www.howtogeek.com/278132/whats-new-in-windows-10s-creators-update/

  • With "convenience PIN : enabled" and "Use Windows Hello for Business: enabled" I still am not able to setup a PIN even with Creators update :-/ – Schneider May 30 '17 at 7:14
0

It looks like your windows device isn't Windows Hello capable. Check: http://www.windowscentral.com/complete-list-laptops-support-windows-hello

  • But the PIN works just fine when it was Azure AD joined... – Schneider Mar 9 '17 at 0:49
  • This is for the end-user version of Windows Hello. Windows Hello for Business is a (very) different beast. Also, the requirements for face and finger print sign in are different from the requirements for PIN sign in. – music2myear Mar 15 '17 at 21:47
0

Just installed a new Windows 10 Enterprise 1809 Feb 2019 update machine from ISO.

All Hello buttons and options were grayed out. I thrashed around for a while. Most web sites only address the various group policy changes that are required for Biometrics and Windows Hello.

In addition to the various Biometrics and Windows Hello GPO, we found it was also necessary to create a single registry key.

We created a User Configuration (rather than a Computer Configuration, which didn't work for us) GPO that set the following registry entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"AllowDomainPINLogon"=dword:00000001

Here's a thread with more info: https://social.technet.microsoft.com/Forums/en-US/84a0bd50-1360-4a94-bfb3-b049ecace521/pin-and-fingerprint-signin-options-unavailable-greyed-out-in-windows-10-1607-enterprise?forum=win10itprogeneral

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.