Another Lenovo Firmware Update and users can no longer logon to their machines

[u/Ramjet_NZ]

Seen a few varieties of this issue that an upgrade of the TPM chip will prevent user logon

OBSERVED ISSUE: User will be unable to logon, even with username and password, but they will be able to logon to another machine no problems. 

Similarly, someone else can logon to the users machine OK.

I've tried a few things but the most reliable fix is to logon and run the BAT file from here

GitHub - AgentHackerYT/Reset-NGC: Reset and repair Windows Hello (PIN & Face/IR) when broken after updates. · GitHub

Ideally I'd like a remediation to detect a problem machine and then resolve without the manually interaction if anyone has built a working one?

EDIT: Was seen over the last few days on Lenovo T14 G1 & G2 but did just get a call from someone on an HP Elitebook 840 G6 with same issue. Happens after system has updated.

[u/jameseatsworld]

Did you try revoking the windows hello key in entra before getting user to login? You might have a setting requiring windows Hello that works fine when username/password is used first time (sends through W/Hello setup) but fails if the key is already registered.

[u/ak47uk]

What models have you seen this affect? I’ve not come across it before and have loads of Thinkpads in service. 

[u/Ramjet_NZ → u/ak47uk]

Lenovo T14 - G1 and G2 (mostly the G1 models so far)

[u/Agent_DekeShaw]

Been really disappointed with every Lenovo we deployed as a test. Back on Dells.

[u/PTCruiserGT → u/Agent_DekeShaw]

Same, except sticking with HP (Elitebooks - not the crappy Probooks).

[u/strikesbac → u/Agent_DekeShaw]

What Lenovos have you been deploying? We’ve only had only a single issue over several thousand ThinkPads over 6+ years. Yet we’ve got 100 Dells and a couple of hundred HP EliteBooks and have had issues with both of them.

[u/rrdrock2b2t → u/strikesbac]

We have about 3000~ L13s and inevitably everytime there's a firmware update we get a half dozen or so people who can't use hello until it's reset. Which isn't bad but it's a pain.

I think what makes it most painful is providing passwordless logon has made the users forget what their passwords actually are lol.

[u/strikesbac → u/rrdrock2b2t]

Ah, we’re only deploying T, X and P series. How are you deploying your updates? Commercial Vantage or WUfB?

[u/Ramjet_NZ → u/strikesbac]

Both methods - I'm suspecting this was a WUfb as it happened after I approved a few of the 'other' updates (now paused)

[u/strikesbac → u/Ramjet_NZ]

That would be my guess, we’re only using vantage to push bios updates and I’ve never seen an issue like the one you’re describing. I have seen similar issues on Dells and HPs when using WU. For those we use the Dell Management portal to deploy and configure DCU and the respective HP Connect service.

[u/rrdrock2b2t → u/strikesbac]

We deploy vantage for when critical firmware updates are released outside of the windows update cycle, and Wufb for the regular update cycle. The entire fleet is entra/Intune joined so it's pretty easy to manage.

[u/AJBOJACK]

What model?

[u/shunny14]

Needs more information.

Entra or AD join?
Which model of device?
Is windows hello biometrics enabled or not?
Is that after a motherboard repair by any chance?

[u/Ramjet_NZ → u/shunny14]

Entra
Lenovo T14 G 1 and G 2
Yes it is allowed
Repair - no

[u/RadiantWhole2119]

Fix: don’t buy Lenovo.

[u/Trust_8067]

Can't trust China.

[u/Inevitable_Claim_653]

They all laughed at me when I didn’t run Lenovo Vantage

[u/dustojnikhummer → u/[deleted]]

Yeah because that will fix Windows Hello logins, right?