Windows 10: ‎A "Windows needs your current credentials" message appears‎

Hello, We are on a Full Cloud environment with Windows Hello for Business enabled. When logging in via PIN, we get a "Windows needs your current credentials" message that appears after a few seconds. We've tried changing the PIN code + reboot and we've tried changing the "Always wait for networf during session opening" policy to Enabled, but it doesn't change anything. Thank you for your help

:)

 

Windows Network Credentials

Hi Keith,

We suggest that you disable Credential Manager before mapping your Drives. Please follow these steps to disable Credential Manager:

• In the search box type “Services”
• Right click on “Services” and select “Run as Administrator”
• In the Services Window, look for Credential Manager Service and click “Stop”.
• Restart the computer and go back the Credential Manager Service and set it to “Automatic”.
• Restart the computer again.

Please keep us updated if you were able to map your drives.

 

Credential Guard lab companion

Source: Credential Guard lab companion Datacenter and Private Cloud Security Blog


See also:

• Enable or Disable Credential Guard in Windows 10 Windows 10 Security System Tutorials
• Verify if Credential Guard is Enabled or Disabled in Windows 10 Windows 10 Security System Tutorials

 

Scheduled tasks run with elevated privileges can't access stored Windows credentials

It seems that after Creators update scheduled tasks run with elevated privileges ('run with highest privileges' option) can't access stored Windows credentials. Is that a bug or an intentional change and is there a recommended workaround?

Here's one way to reproduce the behaviour:

• Start Credential Manger and add some Windows share credentials.
• In a console window type 'cmdkey /list', which should list the added credentials
• Create a task in a task manager:
  • Trigger: on user logon
  • Action: run cmd.exe
  • Tick the 'run with highest privileges' option
• Reboot the machine and log in
• In the console window (let's call it 'console 1') opened from the scheduled task type 'cmdkey /list'. This most likely won't display the credentials added in step 1 and properly listed in step 2. ->
  This looks like a bug
• Now, without closing 'console 1' open another console window as an administrator (let's call it 'console 2') and type 'cmdkey /list'. This will properly list credentials added in step 1.
• Switch to 'console 1' and type 'cmdkey /list' again. This time the credentials are listed properly, unlike in step 5. It looks like an access to Windows credentials was somehow 'unlocked' by step 6.