PIN vs password in standard-user UAC prompt

[Jay Freedman]

I have two copies of Windows 10 running here: Version 1803 build 17134.112 on the host machine and Version 1803 build 17692.1000 (Insider) in a VMware virtual machine. Each of them has both a password and a PIN assigned to the administrator user account, and each of them normally runs in a standard user account. All four accounts are set to prefer the PIN for logon, and that works.

On the VM, when I start a program that requires administrator permission, the UAC prompt also appears with a request for the PIN, which is what I want. However, on the host the same action brings up the UAC prompt with a request for the password, and I have to click the "More choices" link and then click the PIN link before I can enter the PIN. (The password is long and complex, which is painful when I'm changing lots of things that need it.)

The only discussion I've found online about this is https://www.tenforums.com/antivirus-fir ... n-uac.html, but it doesn't arrive at an answer.

Comparing my VM to the host, the only difference I found was the group policy setting at Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Behavior of the elevation prompt for standard users. On the VM, that value is "Prompt for credentials on the secure desktop". On the host it was "Prompt for credentials". I changed the host value and rebooted, but the behavior didn't change.

Any pointers, wild guesses, or commiseration will be appreciated!

[HansV]

Are both admin accounts associated with a Microsoft account?

[Jay Freedman]

Are both admin accounts associated with a Microsoft account?

No, neither of the admin accounts is a Microsoft account. The standard user on the host is a Microsoft account, the admin user on the VM is the Office 365 Enterprise E3 admin (MVP benefit), and the other two are local only.

[HansV]

OK, one more item struck from the list (I found a suggestion that it makes a difference whether the admin account is a Microsoft account).
The only other thing I can offer is commiseration...

[Jay Freedman]

Thank you. I'll try kicking this into the Insider Feedback Hub, and I'll post back if I get any answers.

[HansV]

Good luck!

[JoeP]

On the host, did you actually logon to the Admin account with a pin?

[Jay Freedman]

On the host, did you actually logon to the Admin account with a pin?

Yes, many times. The login screen does default to asking for the pin.

Usually I sign in only with the standard account, but I've also tried leaving the admin account logged in while I then logged into the standard account. There's no change; the UAC prompt still defaults to asking for the admin password.

BTW, on the VM I never explicitly configured the UAC prompt to behave like the login prompt -- it just happened as soon as I defined the pin.

[JoeP]

When you get the credentials prompt, if there a "More choices" option near the bottom what happens when you click on it?

[Jay Freedman]

Yes, there is, and that's what I want to avoid. It takes two extra clicks -- one on More Choices and one to choose the pin instead of the password -- before I can enter the pin. That takes longer than entering the long password.

pin.jpg

[JoeP]

I guess the UI is changed in newer builds. If it survives the development process it will probably show up this fall for "street" releases.