1. Prepare Windows FMD device (instruction)

Starting point:

• You have not yet prepared your device for 2-factor authentication (2FA). (If you have: Go to the instruction on how to register your device).
• You are using a PC or laptop with Windows 10 operating system or higher.
• You are using a so-called "Fully Managed Device" (FMD), which means you usually do not have admin rights for the device. (Are you using a self-managed device (SMD)? Then switch to this instruction for SMD devices).

With "Windows Hello", Microsoft provides you with a convenient way to log in to your Windows device using a PIN. This also applies to so-called FMDs (Fully managed devices) that are administered by the RRZ or by another local IT service team.

Why a PIN

There are security reasons for a PIN, because a PIN, unlike a password, is always directly linked to the corresponding device and stored locally. This means that you cannot automatically use the PIN on other devices.

You set up Windows Hello by opening the login options. You can find them, for example, by clicking on the Windows start icon at the bottom left (1) and then selecting "Settings" (the gearwheel; 2) in the menu.

On the interface that appears, select the "Accounts" option.

In the Accounts section, then select the "Sign-in options" entry.

Then click on the "Windows Hello PIN" option.

Click on "Add".

If you get the notification "This Sign-in Option is only available when connected to your organization's network," make sure you have enabled VPN connectivity before Windows sign-in. This guide (PDF) explains more, starting on page 7.

A window will open informing you that your organization requires Windows Hello. You click on the "Set up PIN" button.

You will now be asked to enter two codes from your 2FA code list. Please make sure that you really enter the requested pair of codes.

You will then be taken back to the option to enter a PIN. Therefore, assign a PIN of your choice. Choose a combination that is easy to remember, but not too simple.

If it helps you, you can also use letters or symbols in addition to numbers. To do this, also click the "Include letters and symbols" checkbox below the input field.

Confirm the entry with "Ok" - your PIN is now set up.

Done! Confirm with "Ok".

If you want to change your initially selected PIN, you can do so by pressing the "Change" button and assigning a new PIN according to the system instructions.

If you ever forget your Windows Hello PIN, you can also assign a new combination via "Forgot PIN". You will be asked for your local device password, so please keep this in mind!

Note: If you remove your Windows Hello PIN and have not stored any biometric data, the option of being able to use your terminal device as a second factor in UHH 2FA is not available! You will then have to switch to the 2FA code list or a device with QR code scanner.

Congratulations!

You have successfully prepared your device for registration with the 2FA app of the University of Hamburg. You can now register your device as a second factor with the 2FA app of the University of Hamburg.