I've seen several cases where a Lenovo firmware or TPM update leaves a specific user unable to sign in to their machine, even though the username and password are correct. That same user can sign in to another computer, and another person can sign in to the affected machine without trouble. The most reliable workaround so far has been signing in with another account and running a script that resets and repairs the Windows Hello PIN and biometric configuration. Has anyone implemented a reliable remediation that can automatically detect affected machines and repair the Windows Hello or NGC data without manual intervention?
3 Answers
This sounds more like a Windows Hello credential problem than a general account or password issue. Since another user can sign in and the affected user works on another computer, an automated remediation could check for broken Hello or NGC state, remove the invalid local enrollment, and prompt the user to register their PIN again.
Before resetting the local Windows Hello data, try revoking the user’s registered Windows Hello credentials in Entra ID. A stale or invalid Hello key may be conflicting with the device, especially in environments that require Windows Hello. After removing the old key, have the user sign in with their password and enroll again.
It would be useful to identify whether this is limited to particular Lenovo models or firmware versions. I haven’t seen it across all ThinkPad deployments, so collecting the model, BIOS version, TPM state, and Windows build from affected systems may help narrow down the trigger.
That matches what we’ve observed: resetting the Hello enrollment fixes the machine, while changing the user’s password or profile usually doesn’t help.