How to Remove a Greyed-Out Windows Hello PIN in Windows 10/11

Windows Hello is Microsoft’s biometric authentication system offering PIN, face, and fingerprint sign-in options. Occasionally, you may find the “Remove PIN” button greyed out in Windows 10/11, preventing you from removing a Windows Hello PIN. This situation typically arises due to organizational policies, misconfigurations, or Windows Hello for Business settings.

In this article, we’ll show you how to remove a greyed-out Windows Hello PIN by running two simple commands. With these steps, you can delete local Windows Hello for Business registrations—including PIN, Face, and Fingerprint—while keeping other sign-in methods like Security Key intact.

Why is the Windows Hello PIN Greyed Out?

When the “Remove PIN” option is greyed out, it often indicates one of the following:

1. Windows Hello for Business Enrollment: If your device is joined to Azure AD or a domain, your organization’s policies might enforce Windows Hello for Business.
2. System Policy or Group Policy: Certain security policies can lock the PIN to strengthen authentication on company-owned or managed devices.
3. Unfinished Setup: Sometimes, incomplete provisioning of Windows Hello for Business can cause the PIN removal option to be unavailable.

By using the Command Prompt method below, you bypass these greyed-out settings and remove the locally stored Windows Hello credentials.

Step-by-Step: Removing the Greyed-Out Windows Hello PIN

Note: You must be signed in on the user account for which you want to remove Windows Hello for Business registrations. If you have multiple accounts, switch to the correct user before proceeding.

1. Open Command Prompt (cmd.exe)
   • Press Win + R, type cmd, and press Enter. Alternatively, search for “Command Prompt” in the Start menu and select “Run as administrator” if elevated privileges are required in your environment.
2. Run the certutil Command
   • In the Command Prompt window, type or paste the following command and press Enter:
   • certutil.exe -DeleteHelloContainer
   • This command deletes all Windows Hello for Business registrations local to your Windows 10/11 device, including PIN, Face, and Fingerprint.
3. Sign Out to Complete the Action
   • Next, type the following command to sign out immediately:
   • logoff.exe
   • Signing out finalizes the deletion process. When you sign back in, the previously stored Windows Hello for Business registrations (PIN, Face, Fingerprint) will be removed.

What about Security Key Sign-In?

A Security Key sign-in method is stored in Azure AD rather than on the local device. Therefore, using the certutil.exe -DeleteHelloContainer command will not remove your Security Key sign-in configuration. You will need to manage or remove that separately through the Azure AD portal or your organization’s identity management system if required.

Additional Considerations

• Administrator Privileges: Depending on organizational policies, you might need admin privileges to run certutil.exe.
• Domain or Azure AD Policies: If your organization enforces Windows Hello PIN or biometric sign-in, the PIN option could reappear upon the next login or policy refresh. Ensure you check with your IT department for permanent removal.

Removing a greyed-out Windows Hello PIN on Windows 10/11 is straightforward when you know the right commands. By running certutil.exe -DeleteHelloContainer and then logoff.exe, you can delete all local Windows Hello for Business credentials in one go. This approach helps when standard removal options are disabled or restricted.

If you still encounter issues, double-check your system policies, or consult your organization’s IT department. Remember that Security Key sign-in remains active as its registration lives in Azure AD. We hope this guide helps you successfully remove your unwanted Windows Hello PIN.