Introduction

Microsoft's April 2025 security update, KB5055523, has introduced significant authentication issues for Windows Hello users. This update, intended to enhance system security, has inadvertently disrupted facial recognition and PIN login functionalities, particularly on devices with specific security features enabled.

Background on Windows Hello and KB5055523

Windows Hello is a biometric authentication feature in Windows 10 and 11, allowing users to log in using facial recognition, fingerprints, or PINs. The KB5055523 update, released on April 8, 2025, aimed to address various security vulnerabilities and improve system performance. However, post-update, users have reported difficulties with Windows Hello authentication methods.

Technical Details of the Issue

The primary issue arises on devices where System Guard Secure Launch or Dynamic Root of Trust for Measurement (DRTM) features were enabled after installing KB5055523. Users performing a system reset via Settings > System > Recovery and selecting 'Keep my Files' and 'Local install' have encountered errors such as:

  • "Something happened and your PIN isn't available. Click to set up your PIN again."
  • "Sorry, something went wrong with face setup."

These errors prevent users from accessing their devices using Windows Hello's facial recognition or PIN features.

Implications and Impact

The disruption affects both individual users and organizations relying on Windows Hello for secure and convenient authentication. The inability to use biometric logins can lead to increased reliance on traditional passwords, potentially compromising security and user experience. Additionally, organizations may face operational challenges and increased support requests due to these authentication failures.

Microsoft's Response and Workarounds

Microsoft has acknowledged the issue and provided interim solutions:

  1. Re-enroll Windows Hello PIN:
  • On the login screen, follow the 'Set up my PIN' prompt to reconfigure your PIN.
  1. Re-enroll Facial Recognition:
  • Navigate to Settings > Accounts > Sign-in options > Facial recognition (Windows Hello) and select 'Set up.' Follow the on-screen instructions to reconfigure facial recognition.

These steps aim to restore Windows Hello functionality until a permanent fix is released.

Related Authentication Issues

In addition to Windows Hello disruptions, the KB5055523 update has caused authentication issues on Windows Server 2025 domain controllers. Specifically, problems have been reported with Kerberos logons and delegations using certificate-based credentials that rely on key trust via the Active Directory msds-KeyCredentialLink field. This affects environments utilizing Windows Hello for Business Key Trust and Device Public Key Authentication (Machine PKINIT). Microsoft has provided a workaround involving registry modifications to mitigate these issues.

Conclusion

While the KB5055523 update was designed to bolster security, it has inadvertently impacted Windows Hello authentication methods. Users and administrators are advised to implement the provided workarounds and stay informed about forthcoming updates from Microsoft to resolve these issues comprehensively.