Allow or Prevent PIN Reset in Windows 10

Windows 10 lets you control whether a user can reset a forgotten Windows Hello PIN from the sign-in screen. You can allow or prevent the reset option with Group Policy or, on editions without that tool, by changing a Windows registry setting; sign in with an administrator account first.

What You’ll Need

A Windows 10 administrator account on the PC.
For the Group Policy method: Windows 10 Pro, Enterprise, or Education. The Local Group Policy Editor is not included with Windows 10 Home.
For the registry method: access to Registry Editor. Changing the wrong value can cause problems, so follow the path and value names carefully.
If the PC is managed by an employer or school, permission from its IT administrator. An organization policy may override your changes.

Step-by-Step

Check which Windows edition you have. Open Settings > System > About and look under Windows specifications for Edition. This tells you whether to use Group Policy or the registry method.
Choose how to set the policy. Use Method A on Pro, Enterprise, or Education. Use Method B on Home, or if you prefer the registry. You only need one method. If the computer is managed, check with IT before making a change.
Method A—open Local Group Policy Editor. Press Windows key + R, type gpedit.msc, and press Enter. Approve the User Account Control prompt if it appears.
Go to the PIN reset policy. In the left pane, open Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business. In the right pane, double-click Allow the use of PIN recovery.
Set whether PIN recovery is allowed. Choose Enabled to allow PIN recovery, or Disabled to prevent it, then select Apply and OK. If you choose Not Configured, Windows or an organization’s policy determines the behavior; it does not explicitly set either choice.
Method B—open Registry Editor. Press Windows key + R, type regedit, and press Enter. Approve the prompt. In Registry Editor, select File > Export and save a backup of the registry before editing.
Find the policy key. Navigate to HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PassportForWork. If PassportForWork does not exist, right-click Microsoft, choose New > Key, and name the new key PassportForWork.
Create or update the recovery value. Select PassportForWork. In the right pane, look for a DWORD (32-bit) Value named EnablePinRecovery. If it is absent, right-click an empty area, choose New > DWORD (32-bit) Value, and enter that exact name. Double-click it, select Decimal, and set its value to 1 to allow recovery or 0 to prevent it. Select OK. A 32-bit DWORD is the correct value type even on 64-bit Windows.
Apply the change and check the result. Close the editor and restart the PC. At the sign-in screen, check whether the PIN reset or forgotten-PIN option is available. You may need to select I forgot my PIN or a similarly worded option; the exact wording can vary. Do not complete a reset merely to test visibility.

Common Mistakes

Confusing a PIN reset with changing a known PIN. This policy controls PIN recovery, not the normal option to change a PIN while signed in. That option is under Settings > Accounts > Sign-in options.
Using the wrong policy location or registry path. The policy is under Windows Hello for Business, and the registry value belongs in PassportForWork. A similarly named setting elsewhere may control something different.
Setting the registry value to the opposite choice. 1 allows recovery; 0 prevents it. Check the value before closing Registry Editor.
Expecting an immediate change. A restart is a useful way to ensure the sign-in screen loads the updated policy. On managed PCs, a central policy may reapply a different setting.
Assuming the option must appear for every account. PIN recovery availability can depend on account type, device configuration, network access, and organizational policy.

Tips

Preventing PIN recovery does not remove an existing PIN or disable all sign-in methods. It only prevents the recovery route controlled by this policy.
Before disabling recovery, make sure users know another supported way to access the account or contact the device administrator if they forget the PIN.
On a shared or managed computer, make the change at the level intended: the policy is computer-wide, not just for the account currently signed in.
To undo your registry change, restore the exported backup or remove only the EnablePinRecovery value you created. Avoid deleting unrelated keys.

Troubleshooting

Group Policy Editor will not open: Windows 10 Home does not include Local Group Policy Editor. Use the registry method instead. Do not download unofficial policy-editor installers.

The policy is missing: Confirm you opened the Windows Hello for Business folder under Windows Components. If it is still absent, use the registry method or check whether your Windows edition and organization’s configuration support the setting.

The reset option still appears after disabling it: Restart the PC, then check the registry value or Group Policy selection again. A work or school administrator may be enforcing a conflicting setting; contact IT rather than repeatedly changing local settings.

The option is unavailable after enabling it: Enabling the policy permits recovery but does not guarantee that the option will show in every sign-in situation. Check that the device is connected as required by the account setup, and ask the administrator whether another policy controls sign-in.

You cannot edit the key: Make sure Registry Editor was opened with an administrator account and that you are using the exact key path. On a managed device, permissions may be intentionally restricted; ask IT for help.

Frequently Asked Questions

Does preventing PIN reset remove my current PIN?
No. It prevents PIN recovery through the controlled option; the existing PIN remains in place.

Can I still change my PIN while I know it?
Yes. Use Settings > Accounts > Sign-in options and choose the PIN change option, if available.

What is the difference between Enabled and Not Configured?
Enabled explicitly allows recovery, while Not Configured leaves the choice to Windows or any higher-priority organization policy.

Does this setting apply to all users on the computer?
It is a computer-level policy, so it is not limited to the administrator account that changed it. An organization’s settings may still take precedence.

Can I use the Group Policy method on Windows 10 Home?
No. Use Registry Editor on Home, following the exact path and value in this guide.

Is a restart required?
A restart is recommended so the sign-in screen can reflect the policy change. If the setting still does not take effect, check for management policies or account-specific requirements.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →