Windows 11 Challenge Phrase (A1B2C3) Appears on Every Boot — Surface Pro 11 (Snapdragon X Elite)

Windows 11 Challenge Phrase (A1B2C3) Appears on Every Boot — Surface Pro 11 (Snapdragon X Elite)

Just adding a detailed report here as this issue seems to be affecting more users, especially on ARM-based devices.

---

🧨 Summary of the Problem

After installing KB5062553 (July 2025 Cumulative Update) on my Surface Pro 11 (Snapdragon X Elite) running Windows 11 24H2 (ARM64), my device immediately prompts for a challenge phrase like “A1B2C3” every time I:

Start the device

Wake it from sleep

Reboot

Even though I have not entered any incorrect PINs, Windows claims there have been too many failed sign-in attempts. Windows Hello Face does not activate at all — the IR camera doesn't turn on — and I’m forced to type the challenge code every single time just to get to the PIN/password screen.

This issue never occurred before KB5062553. It started immediately after the update was installed on 13 July 2025.

---

✅ Answers to Your Follow-Up Questions

Is it a personal device or work/school-managed? This is a personal device, not managed by any organization. It is not joined to any domain, MDM, or Intune profile.

---

Are you able to use other sign-in options? PIN/Password/Fingerprint (if configured)?

Face ID: Completely broken. It no longer activates or attempts to scan my face.

PIN: Only appears after I type the challenge phrase.

Password: Works, but again only accessible after the challenge phrase.

Fingerprint: Not applicable (Surface Pro 11 does not have a fingerprint reader).

So while other sign-in methods technically work, they are blocked by the challenge screen, which defeats the purpose of quick Hello-based sign-in.

---

Have you tried resetting your Microsoft user account? Yes. I’ve verified that:

My Microsoft account is working correctly.

I reset the password via https://account.live.com/password/reset.

I signed in again, confirmed sync and identity verification.

This had no effect. The issue is not tied to account credentials, but seems rooted in Windows Hello token handling after this update.

---

🛠️ Steps I Have Already Tried

Removed and re-added PIN and Face ID via Settings

Ran certutil -deleteHelloContainer from admin Command Prompt

Disabled Fast Startup

Switched to password-only login

Checked for firmware/driver updates via Surface app

Attempted to uninstall KB5062553 — not allowed (update is locked)

None of these resolved the issue long-term. It continues after every reboot or wake.

---

🚩 Root Cause Appears to Be KB5062553

From my testing and timing, this behavior only began immediately after the July 2025 Cumulative Update (KB5062553) was installed. Prior to this, Hello Face worked flawlessly on the same hardware.

Other users are now reporting similar problems on forums and Reddit involving broken Hello flows, challenge phrase screens, and blocked PIN access. Some speculate this is tied to devices with Secure Launch / DRTM enabled — which Surface Pro 11 uses by default with Snapdragon X Elite.

---

✅ Temporary Workaround

The only semi-reliable workaround right now is to remove all Hello methods and log in using the full account password only. This skips the challenge phrase screen.

---

🙏 Request to Microsoft

Please escalate this issue internally. A cumulative update appears to have introduced a major regression in the Windows Hello authentication path for ARM-based devices. Ideally, we need:

An official acknowledgment

A hotfix or workaround (e.g. a script to clean corrupted Hello states properly)

Resolution in the next Patch Tuesday rollout

Happy to provide logs or further troubleshooting info if needed.

Thanks.

Windows 11 Challenge Phrase (A1B2C3) Appears on Every Boot — Surface Pro 11 (Snapdragon X Elite)

Just adding a detailed report here as this issue seems to be affecting more users, especially on ARM-based devices.

---

🧨 Summary of the Problem

After installing KB5062553 (July 2025 Cumulative Update) on my Surface Pro 11 (Snapdragon X Elite) running Windows 11 24H2 (ARM64), my device immediately prompts for a challenge phrase like “A1B2C3” every time I:

Start the device

Wake it from sleep

Reboot

Even though I have not entered any incorrect PINs, Windows claims there have been too many failed sign-in attempts. Windows Hello Face does not activate at all — the IR camera doesn't turn on — and I’m forced to type the challenge code every single time just to get to the PIN/password screen.

This issue never occurred before KB5062553. It started immediately after the update was installed on 13 July 2025.

---

✅ Answers to Your Follow-Up Questions

Is it a personal device or work/school-managed?
This is a personal device, not managed by any organization. It is not joined to any domain, MDM, or Intune profile.

---

Are you able to use other sign-in options? PIN/Password/Fingerprint (if configured)?

Face ID: Completely broken. It no longer activates or attempts to scan my face.

PIN: Only appears after I type the challenge phrase.

Password: Works, but again only accessible after the challenge phrase.

Fingerprint: Not applicable (Surface Pro 11 does not have a fingerprint reader).

So while other sign-in methods technically work, they are blocked by the challenge screen, which defeats the purpose of quick Hello-based sign-in.

---

Have you tried resetting your Microsoft user account?
Yes. I’ve verified that:

My Microsoft account is working correctly.

I reset the password via https://account.live.com/password/reset.

I signed in again, confirmed sync and identity verification.

This had no effect. The issue is not tied to account credentials, but seems rooted in Windows Hello token handling after this update.

---

🛠️ Steps I Have Already Tried

Removed and re-added PIN and Face ID via Settings

Ran certutil -deleteHelloContainer from admin Command Prompt

Disabled Fast Startup

Switched to password-only login

Checked for firmware/driver updates via Surface app

Attempted to uninstall KB5062553 — not allowed (update is locked)

None of these resolved the issue long-term. It continues after every reboot or wake.

---

🚩 Root Cause Appears to Be KB5062553

From my testing and timing, this behavior only began immediately after the July 2025 Cumulative Update (KB5062553) was installed. Prior to this, Hello Face worked flawlessly on the same hardware.

Other users are now reporting similar problems on forums and Reddit involving broken Hello flows, challenge phrase screens, and blocked PIN access. Some speculate this is tied to devices with Secure Launch / DRTM enabled — which Surface Pro 11 uses by default with Snapdragon X Elite.

---

✅ Temporary Workaround

The only semi-reliable workaround right now is to remove all Hello methods and log in using the full account password only. This skips the challenge phrase screen.

---

🙏 Request to Microsoft

Please escalate this issue internally. A cumulative update appears to have introduced a major regression in the Windows Hello authentication path for ARM-based devices. Ideally, we need:

An official acknowledgment

A hotfix or workaround (e.g. a script to clean corrupted Hello states properly)

Resolution in the next Patch Tuesday rollout

Happy to provide logs or further troubleshooting info if needed.

Thanks.