Windows authentication prompting passcode but accepts password

[NickSchumacher]

I am trying to troubleshoot an issue where the user enters the password/passcode. Currently the user will enter their passcode and then are prompted to enter their windows credentials. If the user locks their computer, within 90 minutes they are able to enter their windows credentials. If it is after 90 minutes then the user will need to enter their Pin + RSA token. The problem happens when within the 90 minutes the authentication screen on windows 7 displays "Passcode" in the text box. The user will then enter the pin and the RSA token and get authentication failed. That user will usually lock themselves out. The solution to this is entering the user's windows password instead of the passcode. This does not happen for everybody in our system. Does anyone know what is causing this issue and what the solution could be?

Thanks!!!

[PiersB · Accepted solution]

My guess is there may be an issue with how your "Challenge Groups" are configured and the user's memberships therein. 

I would recommend contacting Customer Support for more detailed assistance.

[JayGuillette]

Piers is right that Challenge group plays into this, but so does Quick PIN unlock, which can be set to Password instead of PIN, then set to work for a specific amount of time until a PassCode is required to unlock

What you describe, user sees PassCode prompt to Unlock Screen but PassCode does not work, Password does, could happen for at least two reasons;

 1. This user is not challenged, or the challenge lookup failed but the fall-back configuration is to Fail with Not Challenged

 2. This user is challenged, but Quick PIN unlock is configured to accept Password, at least until the 'timeout' in minutes is reached, after which a Passcode would be required to unlock the screen

Further complicating this situation is that agents have two settings to trigger the timeout, since the user logged into Windows which is pretty reliable and since the Screen locked which is problematic due to relying on older Microsoft SENS Events to trigger timer based on screen locking. 

You could enable verbose agent logging in the RSA Control Center to try to troubleshoot, but it might be a whole lot more productive just to avoid timers based on when the screen locked.