Windows Hello / PIN / DISM issues after running Win11Debloat on Windows 11 Enterprise

[kuturkutur]

Checklist

• I have searched for existing issues/discussions and didn't find any similar ones.
• I haven't used any other scripts, tools or programs that might have caused this issue.

Windows version

Windows 11 25H2 26200.7462

Script mode/options

Custom Mode

Describe the issue

Hi,

I’m reporting a broader system issue after running Win11Debloat on a Windows 11 Enterprise machine.

Observed problems after running the script:

    Windows Hello is unavailable and PIN functionality is unstable / broken

    DISM is failing, indicating a broken Windows servicing stack / component store

    Lock screen behavior is broken (custom lock screen image does not apply consistently)

System constraints:

    System Restore was disabled by default

    No access to an Enterprise ISO for in-place repair

    System uses only the built-in local Administrator account

Given these conditions, standard recovery paths (DISM, SFC, System Restore, in-place repair) are currently not usable.

Could you please clarify:

    Which policies, features, or registry changes in the script may affect:

        Windows Hello / PIN / NGC / Credential Providers

        Windows servicing stack (CBS / WinSxS / DISM)

        Lock screen & personalization behavior

    Whether there is any safe manual rollback you recommend for these components without reinstalling Windows

    Any known edge cases with Windows 11 Enterprise and/or the built-in Administrator account

I can share the exact script options and logs if needed.

Thanks in advance.



Additional info (to help pinpoint root cause):

    Windows edition/build: Windows 11 Enterprise (exact build: ____ / winver)

    Account: built-in local Administrator only

    System Restore: disabled by default (no restore points)

    Script run method: executed from terminal (exact command / options: ___)

    DISM failure: please advise which components/policies the script changes that could impact CBS/WinSxS/servicing stack.

    DISM output (first failing command + exact error):

        DISM /Online /Cleanup-Image /ScanHealth => (error: ____)

        DISM /Online /Cleanup-Image /RestoreHealth => (error: ____)

    Hello/PIN symptom: (exact message shown in Settings or sign-in options: ____)

    Lock screen symptom: custom image not applied consistently (details: ____)

Steps to reproduce

Steps to reproduce

Start with a clean Windows 11 Enterprise installation.

    System Restore is disabled by default

    Machine uses only the built-in local Administrator account

Download the latest version of Win11Debloat from the GitHub repository.

Run the debloat script with default / recommended options
(no manual modification of the script).

Complete the script execution and reboot the system when prompted.

After reboot, observe the following behaviors:

    Windows Hello becomes unavailable and PIN functionality is unstable or broken

    DISM commands fail, indicating issues with the Windows servicing stack / component store

    Lock screen behavior is inconsistent (custom lock screen image does not apply reliably)

Expected result

Windows Hello and PIN should continue to function normally

DISM should remain operational

Lock screen personalization should behave normally

Actual result

Windows Hello unavailable / PIN issues

DISM failing

Lock screen personalization broken

Notes

No System Restore point was available prior to running the script.

In-place repair is not possible due to lack of an Enterprise ISO.

Error output

No response

Additional context

No response

[Raphire]

Heya,

The only issue that might feasibly be caused by the script is related to the lockscreen. The script does not make any changes that could feasibly affect the login experience (e.g. Windows Hello) or the Windows servicing stack / component store.

I have tried to reproduce this on an evaluation copy of Windows 11 Enterprise (ver. 26200.65.84), but I am unable to find any of the issues mentioned.

Did you also install any Windows updates that may have installed before the restart? The issues seen here could very well be an instance of Windows components getting corrupted by an update. You can check by going to Settings > Windows Update > Update History.

[kuturkutur]

Thanks for the clarification and for taking the time to reproduce this on your side. To be fully transparent about the current state on my end: - We have tried all feasible recovery paths available to us (including policy checks, service validation, and standard repair attempts). - Unfortunately, *none of these actions were able to restore the affected behavior*. As a result, the system is currently left in a *degraded Windows 11 experience*, where: - Windows Hello / PIN functionality is unreliable or unavailable - DISM and standard servicing tools are not functioning correctly - Lock screen personalization behaves inconsistently I understand and accept that the script is not intended to modify Windows Hello or the servicing stack directly. However, from a user perspective, after running the script and rebooting, the system entered a state that is *practically unrecoverable without reinstalling or performing an in-place repair* — both of which are currently not possible in this environment. I’m not trying to attribute direct fault, but rather to highlight that in this specific combination (Windows 11 Enterprise, built-in Administrator account, reboot timing, and potential automatic updates), the end result is a *significantly degraded Windows 11 user experience* that could not be recovered through standard means. If this combination is considered unsupported or risky, it may be worth explicitly documenting it for Enterprise users to avoid similar outcomes. Thanks again for your engagement and for maintaining the project.

…

On Mon, Dec 22, 2025 at 4:13 PM Jeffrey ***@***.***> wrote: *Raphire* left a comment (Raphire/Win11Debloat#401) <#401 (comment)> Heya, The only issue that might feasibly be caused by the script is related to the lockscreen. The script does not make any changes that could feasibly affect the login experience (e.g. Windows Hello) or the Windows servicing stack / component store. I have tried to reproduce this on an evaluation copy of Windows 11 Enterprise (ver. 26200.65.84), but I am unable to find any of the issues mentioned. Did you also install any Windows updates that may have applied after the restart? The issues seen here could very well be an instance of Windows components getting corrupted by an update. — Reply to this email directly, view it on GitHub <#401 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZB64RBEXLC6W6SKP3ULT34C7U7FAVCNFSM6AAAAACPXVHFNGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMOBSGA2DSMRTGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Raphire]

I understand. I'd be happy to help to figure out and hopefully fix the issue. Do you have any more details to share that could pinpoint the issues? Stuff like error codes from logs like C:\Windows\Logs\CBS\CBS.log or C:\Windows\Logs\DISM\dism.log could show more insight.

[kuturkutur]

Relevant excerpt from dism.log (around the first failing DISM command): Relevant excerpt from CBS.log (corresponding error codes): Thanks for the willingness to help, much appreciated. I can confirm that I do have access to both log files you mentioned: - C:\Windows\Logs\DISM\dism.log - C:\Windows\Logs\CBS\CBS.log I’ve reviewed them and will share *only the relevant excerpts* below, focusing on: - DISM failures - component store / servicing stack–related errors - explicit error codes or corruption indicators Full logs are quite large and may contain environment-specific details, so I’ll limit the output to the minimal sections that appear directly related to the observed issues. Please let me know if you’re looking for any *specific commands, timestamps, or error patterns* — happy to provide additional context if needed. Relevant excerpt from dism.log (around the first failing DISM command): Relevant excerpt from CBS.log (corresponding error codes):

…

On Tue, Dec 23, 2025 at 1:43 AM Jeffrey ***@***.***> wrote: *Raphire* left a comment (Raphire/Win11Debloat#401) <#401 (comment)> I understand. I'd be happy to help to figure out and hopefully fix the issue. Do you have any more details to share that could pinpoint the issues? Stuff like error codes from logs like C:\Windows\Logs\CBS\CBS.log or C:\Windows\Logs\DISM\dism.log could show more insight. — Reply to this email directly, view it on GitHub <#401 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZB64Q3KCNMQCLFZRE7END4DBXXHAVCNFSM6AAAAACPXVHFNGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMOBUGQZTSMZYGQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Raphire]

@kuturkutur it seems like the errors aren't being added to the message correctly.

[kuturkutur]

Desktop.zip

Relevant excerpt from dism.log (around the first failing DISM command):
Relevant excerpt from CBS.log (corresponding error codes):

Thanks for the willingness to help, much appreciated.

I can confirm that I do have access to both log files you mentioned:

C:\Windows\Logs\DISM\dism.log

C:\Windows\Logs\CBS\CBS.log

I’ve reviewed them and will share only the relevant excerpts below, focusing on:

DISM failures

component store / servicing stack–related errors

explicit error codes or corruption indicators

Full logs are quite large and may contain environment-specific details, so I’ll limit the output to the minimal sections that appear directly related to the observed issues.

Please let me know if you’re looking for any specific commands, timestamps, or error patterns — happy to provide additional context if needed.

[Raphire]

Thanks for the logs.

Do you have for me the exact errors you get with these commands:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth

Also, could you check if the RPC service is running correctly in Services? Error 0x800706be (See DISM.log) indicates an issue with that.

They were not filled out in the original issue.

[kuturkutur]

Thanks for the follow-up.

Here are the requested details:

RPC-related services:

Remote Procedure Call (RPC): Running / Automatic

RPC Endpoint Mapper: Running / Automatic

DCOM Server Process Launcher: Running / Automatic

DISM results:

DISM /Online /Cleanup-Image /CheckHealth
-> The component store is repairable.

DISM /Online /Cleanup-Image /ScanHealth
-> The component store is repairable.

So at this point:

DISM is functional

The servicing stack is accessible

However, the component store is clearly in a degraded but repairable state

Despite this, Windows Hello / PIN behavior and lock screen issues remain unresolved, and the overall Windows 11 experience continues to be degraded.

This suggests that while the servicing stack is not completely broken, the system entered a state after the script execution and reboot where core components are no longer behaving consistently, and standard self-recovery did not occur.

If you believe the next logical step would be DISM /Online /Cleanup-Image /RestoreHealth, please note that this environment currently has no Enterprise ISO available as a repair source, which limits recovery options.

Let me know if there are any other components you’d like me to verify.

[Raphire]

If the machine is connected to the internet and does not have updates disabled then you should be able to do a repair by pointing DISM to Windows Update:

DISM /Online /Cleanup-Image /RestoreHealth /Source:WindowsUpdate

[kuturkutur]

Thanks for the suggestion.

I did try repairing via Windows Update as a source using the following command:

DISM /Online /Cleanup-Image /RestoreHealth /Source:WindowsUpdate

Unfortunately, the result was:

Error: 0x800f0915
The repair content could not be found anywhere.

This confirms that while the component store is reported as repairable, the required repair payload cannot be retrieved via Windows Update in this environment.

At this point, without access to an Enterprise ISO or an alternative feature source, the system cannot be recovered through standard servicing tools. The Windows 11 experience therefore remains degraded (Hello/PIN behavior, lock screen inconsistencies, etc.), despite all reasonable recovery attempts.

I appreciate your help and guidance throughout this process. From here, it looks like a reinstall or in-place repair with proper media would be the only viable resolution.

[Raphire]

It is looking that way, I hope that you can figure it out!

[royalfifty8]

Hello, I have also ran into this issue after using Win11Debloat but I am using Windows Workstation.