74 openlast updated

HomeOctober 2026 patch cycleKB5121794 Windows 11 26H2: Windows Hello sign-in breaks

HoldEnterprisefrom 2026-10

KB5121794 Windows 11 26H2: Windows Hello sign-in breaks

Part of October 2026 patch cycle

Vendor
Microsoft
Products
Windows 11 26H2, Windows Hello, and Windows Hello for Business
Published
Status
Open

Call: Hold. This applies to fleets where Windows Hello is how people sign in: PIN, fingerprint, face, or Windows Hello for Business. Hold the 26H2 feature update (the KB5121794 enablement package) there until you’ve piloted it on Hello-heavy machines. Everywhere else, pilot it as you would any feature update. This is about 26H2 only. Keep installing the monthly security updates on 24H2 and 25H2.

What breaks: After the upgrade to 26H2, Windows Hello sign-in methods that worked the day before stop working. Users have to sign in with their password, go through “I forgot my PIN,” then remove and re-enroll fingerprint and face. On some machines the PIN option shows as unavailable or asks to be set up again. One reporter did a fresh 26H2 install and Hello worked at first, then broke again after a few reboots.

Who’s hit: Reported, not confirmed by Microsoft. It isn’t on the 26H2 release health page. We’ve seen 3 independent first-hand reports:

  • An admin on X who lost every Hello sign-in method on both of his machines after the upgrade (Oct 6).
  • A Microsoft Q&A post describing it across several managed customer environments, including Intune (Oct 22).
  • A Q&A comment reporting the PIN as unavailable on “most of our fleet” (Oct 21).

AskWoody says it is tracking Hello issues with 26H2 and still hasn’t approved the upgrade. On the other side, one admin upgraded about 60 machines running Windows Hello for Business and saw no sign-in problems. So this isn’t hitting everyone. We don’t yet know what the affected machines have in common.

What to do:

  • Pilot 26H2 on a ring that signs in with Hello every day, and give it more than one reboot before you widen it.
  • Make sure pilot users know their passwords. Recovery starts with a password sign-in.
  • Recovery on an affected machine: sign in with the password, use “I forgot my PIN,” then remove and re-enroll fingerprint and face under Settings > Accounts > Sign-in options.
  • If PIN reset fails on Intune-managed devices: one Q&A reporter got it working again by recreating the Microsoft PIN Reset enterprise applications and re-granting admin consent.
  • Separately, October’s KB5127648 fixes fingerprint sign-in failing after a cold boot. AskWoody says that fix helped with the 25H2-to-26H2 upgrade. Microsoft hasn’t linked it to this issue.

Possibly related, not proven: Two first-hand reports on 26H2 describe apps losing their saved logins after the upgrade. Edge, Discord, Obsidian and Credential Manager sign-ins disappear, and WhatsApp Desktop gets stuck in a crash loop. The Crypto-DPAPI Operational log fills with event 8198, “Could not get the master key,” plus events 8203 and 3. One report came right after the upgrade. The other came after the October preview, KB5127936, when Windows signed in automatically after the update restart. Nobody has shown that this and the Hello breakage share a cause. The workarounds posted in that thread:

  • Sign in only with your normal PIN or password, not the web or “forgot PIN” path.
  • Restore the files in %APPDATA%\Microsoft\Protect from a restore point taken before the update.
  • Turn off “Use my sign-in info to automatically finish setting up after an update” under Settings > Accounts > Sign-in options. That’s worth doing on pilot machines anyway.

On Falcon-protected fleets, 26H2 has another reason to wait.

Sources: Report on X, Oct 6, follow-up on X, Microsoft Q&A: Hello/PIN after 26H2, Microsoft Q&A: lost saved logins (DPAPI), AskWoody, Oct 27, AskWoody on X, 60-machine counterpoint, 26H2 release health, KB5121794, KB5127648 release notes.

Sources

More from October 2026 patch cycle