From ed173f7b59df591c9bb38c60455727a1fb100002 Mon Sep 17 00:00:00 2001 From: mikurii <63286309+mikurii@users.noreply.github.com> Date: Sun, 17 Jul 2022 13:13:05 +0900 Subject: [PATCH 1/3] PINComplexity - Minimum PIN length I visited "https://endpoint.microsoft.com/#blade/Microsoft_Intune_DeviceSettings/DevicesWindowsMenu/windowsEnrollment" to configure "Windows Hello for Business" setting and found out that the default value of "Minimum PIN length" is 6 letters now. I guess the default value has been changed from 4 to 6. --- .../hello-for-business/hello-manage-in-organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index c38b18d8a2..f41baeccf0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -93,7 +93,7 @@ The following table lists the MDM policy settings that you can configure for Win |Special characters|Device or user|2|

0: Special characters are allowed.

1: At least one special character is required.

2: Special characters are not allowed.| |Uppercase letters|Device or user|2|

0: Uppercase letters are allowed.

1: At least one uppercase letter is required.

2: Uppercase letters are not allowed.| |Maximum PIN length |Device or user|127 |

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.| -|Minimum PIN length|Device or user|4|

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.| +|Minimum PIN length|Device or user|6|

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.| |Expiration |Device or user|0|

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.| |History|Device or user|0|

Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.| From 80ade60f0865ebe31d96cb668c251fb1b5a6f005 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Mon, 18 Jul 2022 11:04:27 -0700 Subject: [PATCH 2/3] change other value too --- .../hello-for-business/hello-manage-in-organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index f41baeccf0..71f2f38d04 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -93,7 +93,7 @@ The following table lists the MDM policy settings that you can configure for Win |Special characters|Device or user|2|

0: Special characters are allowed.

1: At least one special character is required.

2: Special characters are not allowed.| |Uppercase letters|Device or user|2|

0: Uppercase letters are allowed.

1: At least one uppercase letter is required.

2: Uppercase letters are not allowed.| |Maximum PIN length |Device or user|127 |

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.| -|Minimum PIN length|Device or user|6|

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.| +|Minimum PIN length|Device or user|6|

Minimum length that can be set is 6. Minimum length cannot be greater than maximum setting.| |Expiration |Device or user|0|

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.| |History|Device or user|0|

Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.| From adf2be6774e4c918810cd18ecd40547eca5f1772 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Mon, 18 Jul 2022 15:15:04 -0600 Subject: [PATCH 3/3] Update hello-manage-in-organization.md Line 78: Add space between period and next sentence. Line 117: Delete stray comma. --- .../hello-for-business/hello-manage-in-organization.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 71f2f38d04..deba83abae 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -75,7 +75,7 @@ The following table lists the MDM policy settings that you can configure for Win |UsePassportForWork|Device or user|True|

True: Windows Hello for Business will be provisioned for all users on the device.

False: Users will not be able to provision Windows Hello for Business.

**Note:** If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices
| |RequireSecurityDevice|Device or user|False|

True: Windows Hello for Business will only be provisioned using TPM.

False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.| |ExcludeSecurityDevice

TPM12|Device|False|Added in Windows 10, version 1703

True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.| -|EnablePinRecovery|Device or use|False|

Added in Windows 10, version 1703

True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).| +|EnablePinRecovery|Device or use|False|

Added in Windows 10, version 1703

True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service. For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).| ### Biometrics @@ -114,7 +114,7 @@ Policies for Windows Hello for Business are enforced using the following hierarc Feature enablement policy and certificate trust policy are grouped together and enforced from the same source (either GP or MDM), based on the rule above. The Use Passport for Work policy is used to determine the winning policy source. -All PIN complexity policies, are grouped separately from feature enablement and are enforced from a single policy source. Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies are enforced on a per policy basis. +All PIN complexity policies are grouped separately from feature enablement and are enforced from a single policy source. Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies are enforced on a per policy basis. >[!NOTE] > Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP.