Bug that forces you to set a pin when installing Windows 10

That response is quite amusing, to say the least; I certainly laughed. Can the PIN be different from the account password, and different on each Windows device they use? Yes. In practice, will the type of "idiot" (your word, not mine) for whom this implementation of PIN was designed actually use a different PIN on each device, and set it to be different from their Microsoft Live account password? No, they will not! You know as well as I do that the "standard idiot" computer user will set the PIN to be the password (because it isn't prevented), use the same one on all his devices (this also is not prevented), and go on with life. Meanwhile, the keylogger has already gotten that PIN, and you know the first thing its owner will do is to try that PIN against the mark's Hotmail account... and it'll work. PIN fail.

I recently updated Windows 10 on 2 new machines. Once they finished updating and it was time to create accounts, I was required to enter both a password and a PIN for the account; there was no functional way to bypass either one. I have certainly read this whole thread (in fact, I've contributed several comments on it); you do have to enter both a PIN and a password when you create a user account.

I do not want the PIN to be required (and at the risk of repeating myself yet again, if it allows alphanumeric content, it's a password, not a PIN). I use strong passwords on my Microsoft account, along with 2FA. I likewise have a strong local password. I want the alternate password to be optional. Windows forces me to create one, and will not let me continue with setup until I do so. Windows does not make it user-friendly to switch the login entry from PIN to password, and it seemed to try to sneak itself back to PIN login at least once after a reboot. If I create a dummy PIN, then go in later and try to remove it, Windows complains, like it's some guy named Guido "suggesting" that I use a PIN, while subtly fondling the club he's going to use on my kneecaps if I don't.

Yes, you don't have to connect the local account with the cloud account. Last time I tried, it took a few mouse clicks and a bit of hunting to find the path to get to that option. Again, the "standard idiot" is not going to go that route, because it won't connect with his OneDrive store or anything else he has attached to his Microsoft account, and it's a PITA for him to find the other option.

All the way around, it's a marginally useful idea with extremely poor implementation. Is it theoretically more secure? Maybe. In practice? Not really, no. On balance, it's a waste of time and a huge frustration, and isn't really more secure than a good password and 2FA. Forcing me to create a PIN (which isn't really a PIN), and displaying what appears to be an option to bypass it but the bypass doesn't work, is a bug, and it needs to be fixed.

A few suggestions:

1. Relabel it from PIN (which insinuates it's purely numerical) to something like "local password", "alternate password", etc. Because that's what it really is. A PIN is what you enter at the ATM or the credit card terminal, because those have only a numeric keypad. If the PIN accepts letters and/or punctuation, it's a password, not a PIN. Label it accordingly.
2. Use a single login box, not separate password and PIN boxes. The code can check whether the password entered was the main one (i.e. the same one as the linked Microsoft account) or the alternate.
3. If the user is going to create an alternate password, enforce its "alternate-ness". Require it to be different from the cloud account password. Even figure out a way to enforce uniqueness across all the user's devices, if you still think that's necessary. But it's totally useless if the alternate password can be the same as the Live account password.
4. For the love of all that is holy, make the alternate password optional. And quit **** about it if the user decides not to use it. Offer it once, accept the decline, and move on, Windows!

First of all, I created this thread. I am not a Microsoft employee. You chose to come cry on "my" thread showing your ignorance of how the PIN works. This is largely a community forum, so when someone takes the time to "educate" you, maybe not show how childish you are by saying blah blah blah. 

It has already been pointed out many times in this thread that "PIN" is poor nomenclature, so you are late to the party on all accounts. If you had read the thread, you would have seen everything you have said has been said 100 times and answered a 100 times.  You don't have to enter both the PIN and the Password. Once you create the PIN that is all you used.

I imagine they made it numeric by default for the type of idiots that post replies to this thread who can't seem to remember a real password. Anyone with half a brain can figure out alphanumeric has more potential combinations.

The PIN only works on the physical device is created on, so unless you are worried about your mom getting on your computer, I am sure a numeric PIN should be fine. For smart people, they check the box and just create an alpha numeric PIN instead. They then enjoy the extra security it provides knowing that even if the password is stolen they can't access their online accounts and the password is useless without their physical device. 

Lastly you don't have to connect an online account. You can choose local login only. In fact that is what I do.

TLDR: Pretty much everything you wrote is either fundamentally incorrect or ignorant

Stop telling us this is more secure since it applies only to this device. That is absurd. This seems like a deal made with NSA to make all device less secure as they can break a pin far easier than a truly secure pass phrase or password.  Shame on Microsoft.

It is more secure. As it has been said many times in this thread, your PIN can be the SAME as a your regular password. It can be alpha numeric. It can be just as long. It can have special symbols. It's not a numeric only PIN. The PIN is applicable to your device only. That means if someone puts a key logger on your device, they still won't have the actual password to your Microsoft Account and therefore they will not be able to access it online. If you hate it that much, just set the PIN to your Microsoft account password and call it a day.

Blah blah blah. If it can be the same as the password, then it is not more secure, and it does not protect the Microsoft account, either, so why even bother? If people set PINs similarly to their debit cards, then a PIN is far less secure than a password. 4 digits 0-9 (which is what most people think of when they hear about PINs) contain significantly fewer bits of entropy than even a 4-digit password which can contain 0-9, a-z, A-Z, and all the punctuation. When users see PIN, they don't think password, they think numbers (what does the N in PIN stand for, hmm...).

You really want to improve security? Do what Apple started doing at least a year ago: when you set up a MacOS user account and log in using your iCloud account, it forces you to set a local password that is different from your iCloud password. It's still linked to the iCloud account, but you never again use the cloud account password, and you aren't forced to enter both a password and a PIN (which can evidently be the same as the password). More importantly, Apple doesn't force you to connect your local account to an iCloud account (or bury the local-only account option so deep that you have to click 3 oddly-labeled buttons to get to it).

TL;DR: Screw the PIN; just do passwords right!!!

Stop telling us this is more secure since it applies only to this device. That is absurd. This seems like a deal made with NSA to make all device less secure as they can break a pin far easier than a truly secure pass phrase or password.  Shame on Microsoft.

It is more secure. As it has been said many times in this thread, your PIN can be the SAME as a your regular password. It can be alpha numeric. It can be just as long. It can have special symbols. It's not a numeric only PIN. The PIN is applicable to your device only. That means if someone puts a key logger on your device, they still won't have the actual password to your Microsoft Account and therefore they will not be able to access it online. If you hate it that much, just set the PIN to your Microsoft account password and call it a day.