windows-itpro-docs/windows/security/identity-protection/hello-for-business/includes/use-pin-recovery.md

author, ms.author, ms.date, ms.topic

author	ms.author	ms.date	ms.topic
paolomatarazzo	paoloma	03/12/2024	include

Use PIN recovery

PIN Recovery enables a user to change a forgotten PIN using the Windows Hello for Business PIN recovery service, without losing any associated credentials or certificates, including any keys associated with the user's personal accounts on the device.

To achieve this, the PIN recovery service encrypts a recovery secret, which is stored on the device, and requires both the PIN recovery service and the device to decrypt.

PIN recovery requires the user to perform multi-factor authentication to Microsoft Entra ID.

• If you enable this policy setting, Windows Hello for Business uses the PIN recovery service
• If you disable or don't configure this policy setting, Windows doesn't create or store the PIN recovery secret. If the user forgets their PIN, they must delete their existing PIN and create a new one, and they must re-register with any services to which the old PIN provided access

	Path
CSP	./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/EnablePinRecovery ./User/Vendor/MSFT/PassportForWork/{TenantId}/Policies/EnablePinRecovery
GPO	Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business

For more information, see PIN reset.