Windows Hello not working every time 1PW is started

fstorch

Beta Channel 1Password for Windows 8.9.10 (80910026)
Windows Hello was running stable for months.
Not sure if a Windows Update or a 1PW Beta version caused it, but I have to enter the Masterpassword now, whenever 1PW is ended and restarted. Works fine when it is just locked.
Why did you do that again?

---

1Password Version: 8.9.10
Extension Version: Not Provided
OS Version: Windows 11
Browser:_ Not Provided

klepp0906

yea i'm having the same issue but on the nightly builds. one of the updates greyed out the "use tpm with windows hello" setting again.

krtickak

I also got this issue after it automatically updated to version 8.9.10-27, so for now I had to downgrade to production release. Because I also had use tpm with windows hello greyed out.

klepp0906

what was the process for downgrading? if you swap channels in settings does it auto-downgrade you or do you have to reinstall 1password from scratch again?

krtickak

I reinstalled 1Password from scratch again.

fstorch

Nightly cannot be installed to test.
_1Password konnte die Installation nicht abschließen und wird alle Änderungen rückgängig machen.
_

Tertius3

The nightly I just installed (1Password for Windows 8.9.10 (80910033)) has enabled TPM settings again, and it seems to work fine as before the issue. I didn't change anything on my system except installing nightly after nightly.

fstorch

Nightly finally was installed: 1Password for Windows 8.9.10 (80910033)
And after restarting 1PW, Hello started to prompt again.

ag_mike_d

Hi folks - thanks for your messages and sorry for any troubles you've encountered with Windows Hello. I'm happy to hear that the latest nightly has fixed this issue. Please let us know if you run into any additional problems with Windows Hello and the of a TPM 2.0.

ref: dev/core/core#18712

RogueScholar

I had run into this issue as well, and before I thought to check in here for the communal wisdom, I managed to solve the issue another way that didn't involve removing or downgrading my 1Password Nightly build installation, though it did involve slightly more work. In the event the problem recurs or it proves useful to the dev team or other users, I'll record the process here.

1. Open 1Password and go to the Settings > Security. Uncheck "Use Windows Hello", close the settings and then press Ctrl+Q on your keyboard to quit 1Password altogether.
2. Open Windows Settings > Accounts > Sign-in options, and deactivate the toggle for "Only allow Windows Hello sign-in for Microsoft accounts on this device" if it is currently active.
3. Navigate up one level in Windows Settings > Accounts and click on "Access work or school". Disconnect any accounts found there. (Only necessary for Microsoft 365/Azure AD users)
4. Right-click the Start button and select "Terminal (Admin)", "Command Prompt (Admin)" or "PowerShell (Admin)", whichever you find there, and at the prompt issue the applicable flavor of the following command:
   • For Command Prompt: %windir%\System32\certutil.exe /DeleteHelloContainer
   • For PowerShell: $Env:windir\System32\certutil.exe -DeleteHelloContainer
5. Press Winkey+R on your keyboard and type tpm.msc in the dialog window that appears, then press the Enter key. Use the toolbar button to show the Action Panel on the right if it isn't already there, and click the "Clear TPM" listing there. Accept the need for the system to immediately reboot and allow it to do so. The boot process length from the power cycle to the lock screen display will roughly double.

This will require you to login to your system for the first time without the benefit of Windows Hello's PIN, facial recognition or biometric authentication, only your account password will suffice. Once that's done, return to Settings > Accounts and reactivate Windows Hello sign-in and re-connect any work or school accounts you may have removed earlier. Finally, open 1Password and toggle "Use Windows Hello" back on, at which point you'll see that the Use TPM option is now restored to its former glory. The next time 1Password starts you will be asked for your Master Password one final time and then be treated to the sweet, sweet comfort of the Windows Hello authentication prompt at long last.

To be sure, this is a draconian means of removing all of the cryptographic tokens stored on your system that facilitate basic user authentication and is not for the faint of heart or those who don't maintain convenient redundant access paths to their account passwords that undergird the Windows Hello abstractions. I was able to accomplish the entire process in around ten minutes (less time than it tooks to type this post, ironically) with the benefit of the 1Password app on my Android phone, which had the passwords needed following the required power cycle. To reiterate, I'm not advocating this as a superior alternative to the solutions others had arrived at earlier in this thread, but rather as a fallback approach in the event it doesn't resolve this problem for you.

klepp0906

Thank you for taking the time and posting the above solution. Works as an alternative or if one becomes impatient waiting for a pending version to resolve ^

0100110

@ag_mike_d I tried to re-enroll Windows Hello but I still have "Use the Trusted Platform Module with Windows Hello" greyed out. I'm using Windows 11 22H2 on a surface book 2, TPM 2.0, latest beta of 1Password. The above solution didn't work.

ag_mike_d

Hello @0100110,

Sorry I missed this comment, but I had replied in an earlier, alternate thread. To keep things tidy, would you mind posting a reply there to let us know if you are still having troubles after my suggestions in that thread? Thanks so much!