deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-21 21:33:38 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fixing acrolinx issues

Browse Source
This commit is contained in:
Matthew Palko
2021-05-04 08:41:40 -07:00
parent 6763889099
commit 5ded138c29
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
View File

@ -40,7 +40,7 @@ If you are a customer of Azure US Government cloud, PIN reset will also attempt
### Resolving Azure AD joined PIN Reset Allowed Domains Issue ### Resolving Azure AD joined PIN Reset Allowed Domains Issue
To resolve this error, a list of allowed domains for PIN reset can be configured using the [ConfigureWebSignInAllowedUrls](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure this policy, see [PIN Reset - Configure Web Sign-in Allowed URLs for Third Party Identity Providers on Azure AD Joined Devices](hello-feature-pin-reset.md#configure-web-sign-in-allowed-urls-for-third-party-identity-providers-on-azure-ad-joined-devices). To resolve this error, a list of allowed domains for PIN reset can be configured using the [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure this policy, see [PIN Reset - Configure Web Sign-in Allowed URLs for Third Party Identity Providers on Azure AD Joined Devices](hello-feature-pin-reset.md#configure-web-sign-in-allowed-urls-for-third-party-identity-providers-on-azure-ad-joined-devices).
## Hybrid Key Trust Logon Broken Due to User Public Key Deletion ## Hybrid Key Trust Logon Broken Due to User Public Key Deletion

6
windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
View File

@ -34,7 +34,7 @@ There are two forms of PIN reset called destructive and non-destructive. Destruc
- Reset from settings - Windows 10, version 1703 - Reset from settings - Windows 10, version 1703
- Reset above Lock - Windows 10, version 1709 - Reset above Lock - Windows 10, version 1709
Destructive and non-destructive PIN reset use the same entry points for initiating a PIN reset. If a user has forgotten their PIN, but has an alternate logon method, they can navigate to Sign-in options in Settings and initiate a PIN reset from the PIN options. If they do not have an alterate way to sign into their device, PIN reset can also be initiated from above the lock screen in the PIN credential provider. Destructive and non-destructive PIN reset use the same entry points for initiating a PIN reset. If a user has forgotten their PIN, but has an alternate logon method, they can navigate to Sign-in options in Settings and initiate a PIN reset from the PIN options. If they do not have an alternate way to sign into their device, PIN reset can also be initiated from above the lock screen in the PIN credential provider.
>[!IMPORTANT] >[!IMPORTANT]
>For hybrid Azure AD joined devices, users must have corporate network connectivity to domain controllers to reset their PIN. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN. >For hybrid Azure AD joined devices, users must have corporate network connectivity to domain controllers to reset their PIN. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN.
@ -137,7 +137,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput
### Confirm that PIN recovery policy is enforced on the client ### Confirm that PIN recovery policy is enforced on the client
The PIN reset configuration for a user can be viewed by running [**dsregcmd /status**](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-device-dsregcmd) from the command line. This state can be found under the output in the user state section as the **CanReset** line item. If **CanReset** reports as DestructiveOnly, then only destructive PIN reset is enabled. If **CanReset** reports DestructiveAndNonDestructive, then non-destructive PIN reset is enabled. The PIN reset configuration for a user can be viewed by running [**dsregcmd /status**](/azure/active-directory/devices/troubleshoot-device-dsregcmd) from the command line. This state can be found under the output in the user state section as the **CanReset** line item. If **CanReset** reports as DestructiveOnly, then only destructive PIN reset is enabled. If **CanReset** reports DestructiveAndNonDestructive, then non-destructive PIN reset is enabled.
#### Sample User state Output for Destructive PIN Reset #### Sample User state Output for Destructive PIN Reset
@ -184,7 +184,7 @@ The PIN reset configuration for a user can be viewed by running [**dsregcmd /sta
- Windows 10, version 1803 or later - Windows 10, version 1803 or later
- Azure AD joined - Azure AD joined
The [ConfigureWebSignInAllowedUrls](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy allows you to specify a list of domains that are allowed to be navigated to during PIN reset flows on Azure AD joined devices. If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, this policy should be set to ensure that authentication pages from that identity provider can be used during Azure AD joined PIN reset. The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy allows you to specify a list of domains that are allowed to be navigated to during PIN reset flows on Azure AD joined devices. If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, this policy should be set to ensure that authentication pages from that identity provider can be used during Azure AD joined PIN reset.
### Configuring Policy Using Intune ### Configuring Policy Using Intune