Windows Hello, SCRIL and Pin Reset Issue

[iffarrukh]

Hi
We are testing Windows Hello for Business with goal to disable password completely with users restricting to login via Windows Hello(by enabling Smart card is required for interactive login) and remove password credential provider.

One thing we are struggling with is, how admins can reset the PIN if users forget their PIN. Right now if we enable PIN reset option for users and user try to reset the PIN, the reset screen asks for user password to verify the identity, but we have disabled the password credentials and by enabling the smart card is required options in user profiles, , Active Directory changes the affected user's password to a random 128 bits of data.. so there is no password anymore.

In short by enabling SCRIL and enforcing user to login via smart card/Windows Hello for Business only, how users can reset their PIN if forgotten(without knowing their password).

[#2]

car

[#3]

It's 2022, Microsoft keeps touting the passwordless future, yet for so many features such as this, it requires a password! I don't think the engineers themselves understand the passwordless concept.

[#4]

@mikey365 I have not found a solution that allows self-service pin reset for the reasons that you have mentioned.  Our plan is to turn on SCRIL for users after they have provisioned their PIN. If they need to reset their PIN the admin will turn off SCRIL for the user, and configure a password (because SCRIL overwrites) then provide that to user to use to reset their pin.  When that is done, turn SCRIL back on.  This is CRAZY but is all that I can find so far