Problems using Microsoft Account password.

[Metanis]

Sorry for the length of this, I've spent about 6 hours troubleshooting over the last 2 days!

This is on my own devices and network. I've tested on 3 different computers. The original symptom was that RDP wouldn't authenticate using my Microsoft Account. It continued to function normally when I used a known local account. Windows authentication will not use my current Microsoft Account password. I can continue to login locally via Windows Hello pin on any machine.

When I try to login via password I get a standard message about invalid password. If I use a web browser to login to the Microsoft portal using the current password it works correctly! I'm using a password manager and copy/paste to ensure I know exactly what the password actually is and have it written down in front of me.

I used CoPilot to help troubleshoot yesterday. Among other things it suggested I delete all entries in Credential Manager, which I've done several times now. It suggested I try logging in from my iPhone and that worked fine with the password. It prompted me to do another password reset which I did and it works on the web site but continues to fail for actual Windows PC login.

I've used Winhance in the past to customize my PC environment so I reverted everything to default settings and rebooted numerous times.

One interesting data point is that if I disconnect my Ethernet cable (Wifi is in Airplane mode), I get a message that Windows is disconnected and it prompts me for my old password and that works just fine. Another data point is that I use the Microsoft Authenticator App on my iPhone for 2FA. Yesterday it showed me login attempts from Brazil and from India which I denied. So that opens the possibility my account is being throttled due to too many invalid login attempts.

Otherwise I'm kind of wondering if Microsoft is having some sort of issues with their servers? Another CoPilot suggestion is that my ISP's network has been blocked? I think my next step is to use my alternate ISP connection.

Anyone else having Microsoft password issues? Windows Hello is not having an issue, just actual password use. Is it possible to use Windows Hello for an RDP session? I've always used a password. I'm kind of stumped at this point.

 

[Metanis]

Nope, switched ISPs and same symptom.

 

[fincoder]

Anyone else having Microsoft password issues?

I was having an issue with Microsoft's Quick Assist yesterday, maybe it shares some code with RDP. It uses a Microsoft account to validate the helper end and that seemed fine, but the helpee was having the connection blocked due to security concerns. Working OK this morning.

 

[HCHTech]

Have you seen any error messages that confirm MS is actively blocking your login?

Pasted from CoPilot:

• Go directly to the Microsoft Security Basics Page.
• Click on Review activity (or go to account.live.com/activity).
• Look through the list. You will see explicit labels confirming Microsoft's blocks:
  • "Blocked sign-in" or "Unsuccessful sync": Confirms Microsoft actively stopped a login attempt from a foreign location, unknown device, or bad password attempt.
  • "Security challenge": Confirms Microsoft throttled the login and forced the user to provide extra verification.

 

[Metanis]

Have you seen any error messages that confirm MS is actively blocking your login?

There were no messages like that. In fact the only ones shown were for successful session logins.

... But, new thing this morning, logging in to one of my problem machines WORKED with the correct, current password!

Last night I also was successful in using my credentials to sign up a freshly installed Windows 10 machine to the Update ESU.

It appears there can be a multi-day lag for Windows to update the local hash upon a password reset when you do it from the web. Normally a person wouldn't notice because their PIN keeps on working. Next time I'll try using the local option in Settings to change the password.

In retrospect, RDP probably would have worked if I used the old password even though I'd changed it nearly 2 weeks before!

 

[britechguy]

In retrospect, RDP probably would have worked if I used the old password even though I'd changed it nearly 2 weeks before!

Unless something has changed, and I doubt it has, you can create a "split-password" situation very easily and prove the following to yourself. Obviously, an encrypted local copy of the password must be maintained for a Microsoft account linked Windows user account so that login can proceed when there is no internet connection. But until you log in with whatever the new password, updated on the Microsoft.com website for the same account, the old, local copy is not replaced with the new.

I showed this trick many times in the Windows 10 era, but don't recall whether or not I've done it since.

1. Establish a Microsoft Account and set its password on Microsoft.com.
2. Establish a Windows user account linked to that Microsoft account, using the initial password.
3. On the Windows machine, for that account, in Settings, Account, Sign-In options make sure the toggle for "Windows Hello only" is OFF.
4. Log Out and Log In again under Windows to confirm the existing password.
5. Change the Microsoft Account password.
6. Log out and Log in again using what is now, for the Microsoft Account itself, the "previous password." You will be able to log in because it is the local encrypted copy of the password that is checked first.

You can continue logging in with the "previous password" on the Windows computer until and unless you use the new password for the first time. When you do that, and it's confirmed against what's on Microsoft's servers, the local encrypted copy is supplanted with the password on the Microsoft Account, and the Windows machine and MS Account passwords are back in sync.

You could go months using the "previous password" so long as you don't use the new one. I did that, once, to see if I'd ever be forced to enter the new password after some number of login cycles.

 

[HCHTech]

until and unless you use the new password for the first time.

Do you mean "use it for the first time" on the LOCAL machine? or "use it for the first time" anywhere....on a mobile device, on portal.office.com, etc. etc. Just clarifying for my own understanding.

 

[britechguy]

Do you mean "use it for the first time" on the LOCAL machine?

Yes.

If you had initially configured 10 PCs using the same Microsoft Account, then changed the Microsoft Account password, the password on each and every one of those machines will remain "the old password" until and unless you enter the new one, at which point it will be verified against what's on Microsoft's server for that MS account, and what matches then supplants the existing local copy.

One thing I don't recall if I ever tried was intentionally entering a bad password, which matches neither the old nor the new, to see if that would trigger the supplanting of the old with the new. But I've played the "keep using the old" trick many times in the past. I could keep using the "old" password for as long as I wished up until I entered the new one for the first time on the PC as part of logging in to the PC, after which it became the only option.

That's pretty much the only way the system could work, with a local encrypted copy being used as "first line verification" and, if that fails, checking with the server to see if what's been entered matches the account's records on the server. If you're online and what you entered matches the server password, the local password is then supplanted. You could, in theory, have machines with no online access for long periods, and those still need to be able to be logged into during that time. The only way they could do this (with password) is if whatever the password was when they were initially set up, or when they last were online, is able to continue being used.

 

[HCHTech]

You could, in theory, have machines with no online access for long periods, and those still need to be able to be logged into during that time. The only way they could do this (with password) is if whatever the password was when they were initially set up, or when they last were online, is able to continue being used.

Makes sense. If they had chosen some sort of maximum period you could go without checking online, then all of those mostly-offline units would break. I wish I could get this kind of explanation for the legion of what appear to be dumb decisions by developers of other apps, maybe it would make more sense and even lower my blood pressure a bit!