Windows 11 must be configured to require a minimum PIN length of six characters or greater.

Windows allows the use of PINs and biometrics for authentication without sending a password to a network or website where it could be compromised. Longer minimum PIN lengths increase the available combinations an attacker would have to attempt. Shorter minimum length significantly reduces the strength.

Note: A different registry location is needed when systems are managed by Intune versus GPO.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\ (For GPO-managed systems) Or Registry Path: \SOFTWARE\Microsoft\Policies\PassportForWork\[guid]\device\policies\PINComplexity (For Intune-managed systems)

Value Name: MinimumPINLength

Type: REG_DWORD Value: 6 (or greater)

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> "Minimum PIN length" to "6" or greater.

For Intune-managed systems:

Revise the Intune policy to set the minimum PIN length to "6" or greater.