Detections
Analytics

Turn on convenience PIN sign-in

Information

This policy setting allows you to control whether a domain user can sign in using a convenience PIN. In Windows 10, convenience PIN was replaced with Passport, which has stronger security properties. To configure Passport for domain users, use the policies under Computer configuration\Administrative Templates\Windows Components\Microsoft Passport for Work.

If you enable this policy setting, a domain user can set up and sign in with a convenience PIN. If you disable or don't configure this policy setting, a domain user can't set up and use a convenience PIN.Note that the user's domain password will be cached in the system vault when using this feature.

Solution

Policy Path: System\Logon
Policy Setting Name: Turn on convenience PIN sign-in

See Also

https://blogs.technet.microsoft.com/secguide/2015/11/13/security-baseline-for-windows-10-build-10240-final/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CSCv6|16.5

Plugin: Windows

Control ID: 36f84834495a8a0b5aed9e0ac713e6794f4c75dab2ed4901a85e3806090706ff