Can't revert Windows Hello for Business (PassportForWork) PIN settings

[xenadmin]

Hi, I'm stupid and need help. A few months ago I executed this (Lovely!) framework in the maximum settings mode and have a few problems since then.
One of them is, that I dislike the high PIN complexity and the PIN rotation. I would like to go back to a 6-digit PIN without rotation. But reverting from the GUI didn't solve the issue. The settings are still in effect. I tried reading the repo, but I can't find the source.
Can you please help me revert the WHfB PIN settings?
Also, Windows Spotlight doesn't work anymore on the Lock screen, and I think it might fall in the same category, but I'm not sure.

[teleportpast]

You’ve probably used the old app Windows Harden Windows Security Module via the GUI or PowerShell. Check out the wiki here: https://github.com/HotCakeX/Harden-Windows-Security/wiki/Harden%E2%80%90Windows%E2%80%90Security%E2%80%90Module

If you want to remove settings with PowerShell, there’s a video for that: https://youtu.be/AksQ0NACRxY?t=332

Otherwise, you can launch the GUI through PowerShell and type Protect-WindowsSecurity -GUI . Just look in the “LockScreen” section for the options you need to turn off. See the guide here: https://github.com/HotCakeX/Harden-Windows-Security/wiki/Harden%E2%80%90Windows%E2%80%90Security%E2%80%90Module#how-to-install-and-use

[HotCakeX]

Thanks so much for help!

[xenadmin]

Hi @teleportpast! Yes, exactly I've always use the exact module you named.
AFAIK I already tried everything you said, but my Windows Hello PIN still requires:

• 6 characters
• 1 lower letter
• 1 number

I removed everything from the category:

[HotCakeX]

Hi @xenadmin

Please install the new app from the Microsoft Store. Unlike the module (which is being deprecated), you can apply and remove any security measure individually and surgically. (no PowerShell needed)

https://github.com/HotCakeX/Harden-Windows-Security/wiki/Harden-System-Security

https://apps.microsoft.com/detail/9p7ggfl7dx57

The same categories exist in the new app with the search feature to find what you're looking for quickly. There is also a Group Policy editor where you can see all of the policies applied in one place, search for any of them and remove them in 1 second.

Here are the policies you mentioned in the new app. All you have to do is to click/tap on the Remove buttons for each of them.

[xenadmin]

@HotCakeX Thanks for your work on this project <3

I wasn't aware of the successor. I installed the store app, as I indeed, was still using the module.

I already tried to remove the category, but my Windows Hello PIN still requires:

• 6 characters
• 1 lower letter
• 1 number

I removed everything from the category:

The same categories exist in the new app with the search feature to find what you're looking for quickly. There is also a Group Policy editor where you can see all of the policies applied in one place, search for any of them and remove them in 1 second.

I also went into the new Group Policy editor. There I chose "Get effective policies system/user":

And searched for keywords like:

• Passport
• Letter
• Pin
• Hello

I found a few hits in paths I didn't know about and deleted them at my own risk, but after a reboot the PIN requirements still haven't changed.

I do work in the IT business, and normally I should know about these policies and their respective keywords.
But for whatever reason, I can't find the cause, because the keys are actually well known and, with your GUI, easily accessible.

[xenadmin]

I guess I found a solution. I put some more thoughts into this problem and I came to the following solution, although it doesn't make 100% sense.

1. I assume, that the PowerShell version in maximum mode is the source of my issues. Although I can't proof that, I guess.
2. Reverting all Lock Screen settings through the old PowerShell GUI, or through the new Store app, does not solve my issue.
3. The requirements for the lower case letter and the history were still in-place.
4. Therefore, I came to the weird conclusion, that this is now some kind of default value and no longer a fault of this project.
5. Therefore, I set the opposite values in the registry myself, enforcing the behavior I would like to see, overwriting whatever has changed in my OS.
6. It works. I was able to change my WHfB PIN to the desired state, and it behaves as expected, before I used the module for the first time.

Just to be clear: I don't blame the module! I just don't know why it works that way and why the revert didn't revert and where these strange new defaults origin from.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity]
"LowercaseLetters"=dword:00000000
"Expiration"=dword:00000000
"History"=dword:00000000

[HotCakeX]

@xenadmin

The policies are here, you don't need to modify registry at all.

They also appear in the new Harden System Security app's Group Policy Editor. There is no need for any guesswork or looking around a lot, i made sure things are easy to find and straightforward (you can look up policies via any of their properties. In the screenshot you see me type "PIN" but you could also type "complexity" or any other word that is included in the policy's path). All you have to do is right-click or tap + hold on the policy and select Delete. :)

The module and the new app both use Group Policy for majority of the policies, including these PIN related policies, so if you removed those policies and restart, and still the policy wasn't changed, then the source of that policy is not the module nor the app. Could be another program you used to configure your system, or Intune policies applied to your system.

[HotCakeX]

P.S the Group Policy path in the screenshot above can also be found in the Lock Screen category's document, which has a link to this page: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/policy-settings?tabs=feature#pin-complexity