TPM and Windows Hello - Windows reverts to PIN after 1st log on using Face

[GH4TP]

Device Information

System Model or SKU

Please select one of the following

• Framework Desktop (AMD Ryzen™ AI 300 PRO Series)

BIOS VERSION

3.04

Standalone Operation

Are you running your mainboard as a standalone device. Is standalone mode enabled in the BIOS?

• Yes
• No

Describe the bug

In Windows 11 10.0.26200 Build 26200 Windows Hello reverts to a PIN rather than Face. If I make a change to any of the TPM settings Windows will challenge me again with a Face Hello but subsequent challenges when logging on revert to PIN

Steps To Reproduce

Steps to reproduce the behavior:

1. Go to 'Settings>Accounts>Sign-in options'
2. Click on 'Facial recognition' to set up Face id
3. Reboot. You should be challenged to use your Face
4. Reboot again. This time the log on has reverted to PIN
5. Make a change in BIOS to any of the TPM related options and go through the steps again

Expected behavior

Face ID should be retained as the default

Operating System (please complete the following information):

• Windows 11 10.0.26200 Build 26200

[JohnAZoidberg]

What camera are you using?

If I make a change to any of the TPM settings

For example what?
I think this may be expected behavior - how windows is supposed to act.

[GH4TP]

What camera are you using?

A Logitech Brio

I think this may be expected behavior - how windows is supposed to act

What makes you think that? PIN is a fallback, Face is the default

[GH4TP]

For example what?

Setting TPM Operation to Enable
Erase all Secure Boot Settings and starting again

BTW, can you point me to the Framework Insyde BIOS user guide, please?

[JohnAZoidberg]

Erase all Secure Boot Settings and starting again

Erase secureboot settings and then no keys? Or reset to factory defaults with windows keys?
What does "start again" mean?

You are not regularly erasing SecureBoot settings, right?
This is a one-time issue for you?
Or are you just enabling/disabling secureboot?

I think this may be expected behavior - how windows is supposed to act

What makes you think that? PIN is a fallback, Face is the default

Because you are erasing security related settings. I am not familiar with exactly how Windows Hello with Face treats firmware/secureboot changes, since our laptop cameras don't support this, but I am not surprised by the behavior you are seeing. Windows also easily disables PIN login and requires online account reset when many secureboot/firmware settings change.

[GH4TP]

Erase secureboot settings and then no keys? Or reset to factory defaults with windows keys?
What does "start again" mean?

So, these are steps to recreate the experience. These are not steps I take every day.

You are not regularly erasing SecureBoot settings, right?
This is a one-time issue for you?
Or are you just enabling/disabling secureboot?

Secure boot is enabled.
I am unable to have Hello challenge me with Face ID except for the one time post making the changed to TDM I've mentioned
Other than those specific answers I'm unsure what you're getting at. Perhaps a little more context for your questions?

I am not familiar with exactly how Windows Hello with Face treats firmware/secureboot changes, since our laptop cameras don't support this, but I am not surprised by the behavior you are seeing.

With all due respect (and I have plenty of respect for you) Framework is now not just a Laptop company. And Windows is the primary OS supported. So there is a need to develop an understanding.

I'm sure you're already across all of the docu but ... there's some here, the Security Book here and of course the SDK here

Windows also easily disables PIN login and requires online account reset when many secureboot/firmware settings change.

I'm not sure what you're getting at here or the relevance in relation to this issue?

[GH4TP]

Is there a Framework BIOS guide? One that goes through all of the options and their implications?
Thanks