Skip to main content
October 11, 2021
Question

1Password8/Windows and Windows Hello on first signin?

  • October 11, 2021
  • 47 replies
  • 1211 views

Hi! I'm trying to figure out why manually entering my master password is required on first run of the 1Password 8 app on Windows, and Windows Hello can only be used after initial sign in when 1Password relocks. On iPhone/iPad (and maybe Mac?), you can use FaceID for the initial sign in. Is that difference intentional (it seems like it from the release notes), and if so what is the reasoning?

Thanks!


1Password Version: 8.2.2
Extension Version: Not Provided
OS Version: Windows 11

47 replies

MikeT
1Password Employee
1Password Employee
March 23, 2022

I would suggest that anyone else who has this issue, waits for official documentation from 1Password, before proceeding with troubleshooting.

Correct, there is no need to do the command line as the same can be accomplished by turning off the biometric or PIN feature in the Windows Setting's Accounts > Sign-in options and re-enrolling the biometric or PIN; it'll go into the TPM's hardware store. This is assuming Windows has confirmed there is TPM enabled (click Start, search for Security Processor).

We will be adding some docs on this once this is working for folks in the way we expect it to work.

March 24, 2022

Cool, with this information I was able to determine with certutil my Windows Hello PIN was software-based, not TPM-based. It seems I created the pin a long time ago where the TPM wasn't enabled in BIOS.

I removed the PIN and re-ecreated it, now certutil shows the PIN is hardware-based and I was able to enable TPM support in 1Password.
If 1Password is started, I have to enter now only the PIN, not the full master password.

Thanks!

ps. by the way, just changing the PIN didn't move it from software-based to hardware-based according to certutil. Since the option to remove the pin was greyed out in Windows settings, I used certutil -DeleteHelloContainer to forcibly remove the pin. I logged off, then back on and then I enrolled a new PIN. Now it was finally hardware-based.

pbryanw
March 24, 2022

This was also an issue for me - I couldn't remove my PIN code in Windows settings.

I've since discovered that you have to disable the "For improved security, only allow Windows Hello sign-in..." checkmark in Accounts -> Sign-in options, before you can remove your PIN. More info here:
https://www.thewindowsclub.com/windows-hello-pin-remove-button-greyed-out

March 24, 2022

Former Member glad it worked for you too, disabling / enabling Windows Hello should have the same effect as @MikeT mentioned. Although in your case it was greyed out, so you had no choice but to force delete!

1P_PeterG
1Password Alum
March 25, 2022

Thanks for the updates, folks. We appreciate you keeping us apprised of how this is working for you!

March 28, 2022

As I posted on the Reddit thread as well, thanks to baldersz, this fixed the greyed out checkbox and got Windows Hello working with 1Password again in general.

Thanks 1Password and baldersz!

MikeT
1Password Employee
1Password Employee
March 28, 2022

That's great to hear, thanks for letting us know.

We've just shipped 1Password 8.6.1 stable update to everyone with more Windows Hello improvements including extending TPM support to AMD's fTPM and vTPM in certain virtualization solutions.