Why does Windows 10 disable the PIN login option after multiple shutdowns?

9,684

Yes. That is why. And no, if somebody else logs in correctly using the password, they can manually reset the counter for the PIN, but it doesn't mean that whoever has been trying to boot force the PIN has given up. The PIN is really weak. If someone is trying to brute force it, it needs to be disabled until that problem is identified or dismissed.

Share:
9,684

Related videos on Youtube

appa yip yip
Author by

appa yip yip

twenty two. graduated in computer science.

Updated on September 18, 2022

Comments

  • appa yip yip
    appa yip yip over 1 year

    I was tuning my bootloader and had to restar my computer multiple times to test the changes. After a few reboots, when I tried to login to my Windows 10 account, the following error appeared after I typed the PIN numbers:

    Esta opção de entrada está desabilitada devido a tentativas de entrada com falha ou a desligamentos repetidos. Use outra opção de entrada ou mantenha seu dispositivo ligado pelo menos duas horas e tente novamente.

    Which is the Portuguese for something in the lines of

    This login option is disabled due to invalid login attempts or repeated shutdowns. Use another login option or keep you device on for at least two hours and try again.

    Which got me wondering: why does Windows 10 disable PIN login after multiple reboots/shutdowns?

    My first guess would be to prevent someone from trying n - 1 combinations (where n = amount of attempts before the PIN option is disabled), rebooting and repeating. But if that was the case, it would be reasonable to re-enable the PIN option after a successful login using the password (which is not the case).

  • appa yip yip
    appa yip yip over 4 years
    That makes sense, but doesn't mention anything about the repeated shutdowns/reboots (not even on the Docs article). Do you know (or happen to have a source) for something related to that?
  • appa yip yip
    appa yip yip over 4 years
    Yeah, but the PIN can only be used with physical access to the machine, right? So, if the user logs in, it means that it is not a bruteforce (or if it was, it is already successful), so why not re-enable the PIN option? Also, do you have any source for what you said?
  • Moab
    Moab over 4 years
    I haven't found anything.