One thing we are struggling with is, how admins/users can reset the PIN if users forget their PIN. Right now if we enable PIN reset option for users and user try to reset the PIN, the reset screen asks for user password to verify the identity, but we have disabled the password credentials and by enabling the smart card is required options in.
Recently I have been troubleshooting a nasty Windows Hello for Business problem which prevented all users in a tenant from resetting their Windows Hello for Business PIN's on Azure AD joined devices while getting the error CAA20004.
Issue
I can't reset my Windows Hello pin. I DO NOT have the option to 'Remove' the pin in the 'Sign In Options' settings. I have tried to reset the passcode on lock screen, but it doesn't work either because my domain credentials aren't tied to the passcode portion. I have removed my fingerprint and the.DAT file assocaited with it. So we recommend you third party program Windows Password Key to reset your login password. Step 1: Download and install the Windows Password Key into an accessible computer. Insert a CD/DVD or USB disk into this computer and launch the software, click 'Burn' button to make a bootable password reset disk.
You can create a PIN (Personal Identification Number) to use in place of passwords. Having a PIN makes it easier to sign in to Windows, apps, and services.Wh. Resetting Your Windows PIN When Already Signed In If you happen to have access to your Windows device, but still want to reset your PIN, start by opening the Start menu and then clicking the Settings gear. In the Windows Settings popup, click 'Accounts.' Then, click Sign-In Options Windows Hello PIN I Forgot My PIN.
When clicking on 'I forgot my PIN':
After completing the account sign-in and MFA challenge the Error CAA20004 came up:
Troubleshooting
The Azure AD Portal shows us 'Failure reason: other'. Gigabyte amd radeon hd 7870 drivers driver.
While recording all the https traffic to Microsofts oauth2 endpoint with Fiddler this finally unveils usable information:
AADSTS65001: The user or administrator has not consented to use the application with ID ‘ 9115dd05-fad5-4f9c-acc7-305d08b1b04e' named ‘ Microsoft Pin Reset Client Production'. Send an interactive authorization request for this user and resource.
Mac photo booth effects for windows. The error indicates that an application registration is missing in the tenant for the application 'Microsoft Pin Reset Client Production'
Solution
After a short search I found a matching Microsoft docs article. Instead of reading through the whole article the only thing I needed to do was consenthing to the: Microsoft PIN Reset Service production application and also for the Microsoft PIN Reset Client production
(just klick on the links in order to consent to the app registrations) as tenant admin. Although in some tenants I have only seen the 'Microsoft PIN Reset Service production' and PIN resets are working without the 'Microsoft PIN Reset Client production'.
When checking the registered enterprise applications in Azure AD the 'Microsoft Pin Reset Client Production' was visible:
… and resetting Windows Hello for Business PIN's is from now on possible and works like a charm.
Final words
Did you encounter the same difficulties? Or do you know why some tenants only have the 'Microsoft PIN Reset Service production' and not the 'Microsoft PIN Reset Client production' registered? I am curious to read your experiences in the comments. Play facade game online no download.
-->Applies to
- Windows 10
When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello.
Example
Let's suppose that you have set up a PIN for your Microsoft account on Device A. You use your PIN to sign in on Device A and then change the password for your Microsoft account.Because you were using Device A when you changed your password, the PIN on Device A will continue to work with no other action on your part.
Suppose instead that you sign in on Device B and change your password for your Microsoft account. The next time that you try to sign in on Device A using your PIN, sign-in will fail because the account credentials that Hello on Device A knows will be outdated.
Note
When checking the registered enterprise applications in Azure AD the 'Microsoft Pin Reset Client Production' was visible:
… and resetting Windows Hello for Business PIN's is from now on possible and works like a charm.
Final words
Did you encounter the same difficulties? Or do you know why some tenants only have the 'Microsoft PIN Reset Service production' and not the 'Microsoft PIN Reset Client production' registered? I am curious to read your experiences in the comments. Play facade game online no download.
-->Applies to
- Windows 10
When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello.
Example
Let's suppose that you have set up a PIN for your Microsoft account on Device A. You use your PIN to sign in on Device A and then change the password for your Microsoft account.Because you were using Device A when you changed your password, the PIN on Device A will continue to work with no other action on your part.
Suppose instead that you sign in on Device B and change your password for your Microsoft account. The next time that you try to sign in on Device A using your PIN, sign-in will fail because the account credentials that Hello on Device A knows will be outdated.
Note
This example also applies to an Active Directory account when Windows Hello for Business is not implemented.
How to update Hello after you change your password on another device
How To Reset Microsoft Pin
- When you try to sign in using your PIN or biometric, you will see the following message: Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.
- Click OK.
- Click Sign-in options.
- Click the Password button.
- Sign in with new password.
- The next time that you sign in, you can select Sign-in options and then select PIN to resume using your PIN.
How To Reset Windows Hello Pins
Related topics
