Facial Recognition Challenge Phrase Issue on Windows Surface Pro

Question

Facial Recognition Challenge Phrase Issue on Windows Surface Pro

Scott Moreland 5

My new Microsoft Surface Pro has been set up to use facial recognition, which was functioning properly until today. Now, it's requesting a challenge phrase that i don't have. The device previously used the camera for login. What steps can be taken to resolve this issue? Access to the new Surface is currently blocked without the challenge phrase.

S.Sengupta 25,591 Reputation points MVP

2025-06-03T00:49:16.6933333+00:00

Default phrase is A1B2C3

Re:

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq

Is it a personal device or work/school-managed?

Are you able to use Other Sign-in options? PIN/Password/Fingerprint (if configured)?

Have you tried resetting your Microsoft User Account?

Visit https://account.live.com/password/reset

Follow steps to reset your Microsoft account password.
Yuvraj 5 Reputation points

2025-07-14T23:57:54.9266667+00:00

Windows 11 Challenge Phrase (A1B2C3) Appears on Every Boot — Surface Pro 11 (Snapdragon X Elite)

Just adding a detailed report here as this issue seems to be affecting more users, especially on ARM-based devices.

🧨 Summary of the Problem

After installing KB5062553 (July 2025 Cumulative Update) on my Surface Pro 11 (Snapdragon X Elite) running Windows 11 24H2 (ARM64), my device immediately prompts for a challenge phrase like “A1B2C3” every time I:

Start the device

Wake it from sleep

Reboot

Even though I have not entered any incorrect PINs, Windows claims there have been too many failed sign-in attempts. Windows Hello Face does not activate at all — the IR camera doesn't turn on — and I’m forced to type the challenge code every single time just to get to the PIN/password screen.

This issue never occurred before KB5062553. It started immediately after the update was installed on 13 July 2025.

✅ Answers to Your Follow-Up Questions

Is it a personal device or work/school-managed? This is a personal device, not managed by any organization. It is not joined to any domain, MDM, or Intune profile.

Are you able to use other sign-in options? PIN/Password/Fingerprint (if configured)?

Face ID: Completely broken. It no longer activates or attempts to scan my face.

PIN: Only appears after I type the challenge phrase.

Password: Works, but again only accessible after the challenge phrase.

Fingerprint: Not applicable (Surface Pro 11 does not have a fingerprint reader).

So while other sign-in methods technically work, they are blocked by the challenge screen, which defeats the purpose of quick Hello-based sign-in.

Have you tried resetting your Microsoft user account? Yes. I’ve verified that:

My Microsoft account is working correctly.

I reset the password via https://account.live.com/password/reset.

I signed in again, confirmed sync and identity verification.

This had no effect. The issue is not tied to account credentials, but seems rooted in Windows Hello token handling after this update.

🛠️ Steps I Have Already Tried

Removed and re-added PIN and Face ID via Settings

Ran certutil -deleteHelloContainer from admin Command Prompt

Disabled Fast Startup

Switched to password-only login

Checked for firmware/driver updates via Surface app

Attempted to uninstall KB5062553 — not allowed (update is locked)

None of these resolved the issue long-term. It continues after every reboot or wake.

🚩 Root Cause Appears to Be KB5062553

From my testing and timing, this behavior only began immediately after the July 2025 Cumulative Update (KB5062553) was installed. Prior to this, Hello Face worked flawlessly on the same hardware.

Other users are now reporting similar problems on forums and Reddit involving broken Hello flows, challenge phrase screens, and blocked PIN access. Some speculate this is tied to devices with Secure Launch / DRTM enabled — which Surface Pro 11 uses by default with Snapdragon X Elite.

✅ Temporary Workaround

The only semi-reliable workaround right now is to remove all Hello methods and log in using the full account password only. This skips the challenge phrase screen.

🙏 Request to Microsoft

Please escalate this issue internally. A cumulative update appears to have introduced a major regression in the Windows Hello authentication path for ARM-based devices. Ideally, we need:

An official acknowledgment

A hotfix or workaround (e.g. a script to clean corrupted Hello states properly)

Resolution in the next Patch Tuesday rollout

Happy to provide logs or further troubleshooting info if needed.

Thanks.

Windows 11 Challenge Phrase (A1B2C3) Appears on Every Boot — Surface Pro 11 (Snapdragon X Elite)

Just adding a detailed report here as this issue seems to be affecting more users, especially on ARM-based devices.

🧨 Summary of the Problem

After installing KB5062553 (July 2025 Cumulative Update) on my Surface Pro 11 (Snapdragon X Elite) running Windows 11 24H2 (ARM64), my device immediately prompts for a challenge phrase like “A1B2C3” every time I:

Start the device

Wake it from sleep

Reboot

Even though I have not entered any incorrect PINs, Windows claims there have been too many failed sign-in attempts. Windows Hello Face does not activate at all — the IR camera doesn't turn on — and I’m forced to type the challenge code every single time just to get to the PIN/password screen.

This issue never occurred before KB5062553. It started immediately after the update was installed on 13 July 2025.

✅ Answers to Your Follow-Up Questions

Is it a personal device or work/school-managed?
This is a personal device, not managed by any organization. It is not joined to any domain, MDM, or Intune profile.

Are you able to use other sign-in options? PIN/Password/Fingerprint (if configured)?

Face ID: Completely broken. It no longer activates or attempts to scan my face.

PIN: Only appears after I type the challenge phrase.

Password: Works, but again only accessible after the challenge phrase.

Fingerprint: Not applicable (Surface Pro 11 does not have a fingerprint reader).

So while other sign-in methods technically work, they are blocked by the challenge screen, which defeats the purpose of quick Hello-based sign-in.

Have you tried resetting your Microsoft user account?
Yes. I’ve verified that:

My Microsoft account is working correctly.

I reset the password via https://account.live.com/password/reset.

I signed in again, confirmed sync and identity verification.

This had no effect. The issue is not tied to account credentials, but seems rooted in Windows Hello token handling after this update.

🛠️ Steps I Have Already Tried

Removed and re-added PIN and Face ID via Settings

Ran certutil -deleteHelloContainer from admin Command Prompt

Disabled Fast Startup

Switched to password-only login

Checked for firmware/driver updates via Surface app

Attempted to uninstall KB5062553 — not allowed (update is locked)

None of these resolved the issue long-term. It continues after every reboot or wake.

🚩 Root Cause Appears to Be KB5062553

From my testing and timing, this behavior only began immediately after the July 2025 Cumulative Update (KB5062553) was installed. Prior to this, Hello Face worked flawlessly on the same hardware.

Other users are now reporting similar problems on forums and Reddit involving broken Hello flows, challenge phrase screens, and blocked PIN access. Some speculate this is tied to devices with Secure Launch / DRTM enabled — which Surface Pro 11 uses by default with Snapdragon X Elite.

✅ Temporary Workaround

The only semi-reliable workaround right now is to remove all Hello methods and log in using the full account password only. This skips the challenge phrase screen.

🙏 Request to Microsoft

Please escalate this issue internally. A cumulative update appears to have introduced a major regression in the Windows Hello authentication path for ARM-based devices. Ideally, we need:

An official acknowledgment

A hotfix or workaround (e.g. a script to clean corrupted Hello states properly)

Resolution in the next Patch Tuesday rollout

Happy to provide logs or further troubleshooting info if needed.

Thanks.

1 answer

Your answer

S.Sengupta 25,591 Reputation points MVP

2025-06-03T00:49:16.6933333+00:00

Default phrase is A1B2C3

Re:

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq

Is it a personal device or work/school-managed?

Are you able to use Other Sign-in options? PIN/Password/Fingerprint (if configured)?

Have you tried resetting your Microsoft User Account?

Visit https://account.live.com/password/reset

Follow steps to reset your Microsoft account password.

Answer 1

Hi Scott,

Thank you for writing to us. Is your problem resolved?

In case if it persists, just type in the default phrase which is “A1B2C3”. After logging in you can disable or do a work around.

How to Disable or Work Around It

That "Challenge Phrase" prompt is a security feature in Windows that kicks in after multiple failed login attempts. Normally, it should stop appearing after some time, but since it's persisting, try these fixes:

Clear Cached Credentials
Press Win + R, type netplwiz, and hit Enter.
Select your account and click Properties.
Under the Advanced tab, clear any saved credentials or auto-login settings.
Restart and check if the issue persists.
Reset Windows Login Threshold
Press Win + R, type secpol.msc, and hit Enter (not available in Windows Home editions).
Go to Account Lockout Policy > Account Lockout Threshold.
Set it to 0 (unlimited attempts) and confirm.

If secpol.msc isn’t available:

Open Command Prompt (Admin) and run:

net accounts /lockoutthreshold:0

Restart your PC.
Check Group Policy (if applicable)
Open Group Policy Editor (gpedit.msc).
Navigate to:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

Look for "Interactive logon: Machine account lockout threshold" and set it to 0.
Restart.
Reset PIN & Biometrics
Open Settings > Accounts > Sign-in options.
Remove and re-add your PIN and Fingerprint/Face Unlock.
Restart your PC.

This has been a known issue that is related to the April Update this year that affected Surface and ARM Devices. Our Engineering team has been working to find a fix for this.

I hope the above steps help you find a workaround.

All the best,

Restee M.

Microsoft Community Contributor

Share via

Facial Recognition Challenge Phrase Issue on Windows Surface Pro

1 answer

Your answer