Ok, long one guys.
Fault: The initial fault that we found was that when we go to reset an AzureAD created profile on the laptop. Removing the AD link goes fine, the local user account has been fine through this whole process. We rename the removed user folder to keep a sideways backup of their desktop/documents and then rejoin the PC to AzureAD. This connects fine, does the normal thing it does if the PC was out of the box.
Reboot the PC, log in as the AzureAD user that joined the PC to the domain, "Welcome to Windows" splash screen does its thing, then where I'd expect to see the "Set up Windows Hello - Now set up your PIN" screens on first login but instead the screen is just black with a cursor.
Ctrl-Alt-Del will bring up the security screen fine, can open task manager and log out OK and the login screen shows up. After a bit of button pressing I can hit the Win key to pull up the start menu and peek preview will ghost the overlay and I can see the wallpaper and icons fine.
Profile removal: This is done manually via regedit removing the profile's UID in ProfileList after removing AzureAD. Also done through local user manager. Both remove the profile fine, but neither fixes the issue.
Troubleshooting: So we've ruled out graphics issues, it isn't the Win+P issue that was a thing during the insider previews pre-RTM, it appears to just be localised to AzureAD profiles that have been on the PC before. The only way we can find to get past it is to do a soft or hard Windows reset and start from scratch. Obviously this turns a 15-20 minute profile reset into a 3 hour ordeal involving shipping the laptop back to this office.
And to sum up further details than I've described above:
- Two different hardware specs, HP and Lenovo laptops
- Both fully up to date Win 10
- Different AzureAD domains but both have PIN requirements
- Other local accounts work fine
- Removing a user and rejoining to AAD with a different user works OK
- Can replicate issue easily
The only thing that we haven't tried yet is to see if we change the password policy to remove the Windows Hello and PIN requirements but we can't make those changes on a production system just to test a suspicion.