surface laptop gen1, cannot use faceID nor PIN

Since I received the replaced surface laptop (the previous one's battery was swelling), I cannot login via PIN or faceID. It always errors out "the credential cannot be verified". I am in an enterprise network and AD. I tried to disable FaceID then reenable, or change local group policy, none of them fixes the issue. Shall I get a new surface laptop