Remote desktop refuses my credentials on a fresh Windows install that uses an account PIN

The key thing to understand is that the PIN is not a password. It is a local credential tied to that specific device and its secure hardware, and it unlocks a key stored there. It has no meaning to anything else and cannot be sent over a network, which is exactly why it is more secure than a password for local sign-in.

Remote desktop authenticates with an account and password. So you need the password of the online account, not the PIN.

The usual reason that fails is the second half: on a fresh install configured this way, signing in with a password is often effectively disabled locally, and the account may never have had a usable password established on that device.

The supported route is to re-enable password sign-in for the account and confirm the online account's password works locally, at which point remote desktop accepts the same credential.

The format of the username trips up nearly everyone attempting this, and it is worth stating explicitly.

For an online account, the username for remote desktop is generally the full account address, not the display name and not the local profile folder name. Many people try the name they see on the sign-in screen, which is a display name and is not an account identifier at all.

Another frequent cause: the account must be permitted to connect. Being an administrator is usually enough, but on some configurations the account has to be added explicitly to the list of users allowed remote access.

And if the account has multi-factor authentication enabled, that adds a further complication, because the remote desktop prompt has nowhere to present a second factor. Configurations exist that handle it, and it is the thing to check before assuming the password is wrong.

The alternative that sidesteps all of this: create a local account on the machine specifically for remote access.

A local administrator account with an ordinary password authenticates against the machine directly, with no online account, no PIN and no second factor in the path. Connect to it by machine name and account name.

This is what I do on any machine I need to reach remotely, precisely because it keeps remote access independent of whatever the online account is doing. It also means that if the online account has a problem — expired password, changed policy, a device-trust issue — remote access still works.

The trade is another account with administrative rights, so give it a strong unique password and do not use it for anything else.

One more thing worth checking before you change any settings: whether the edition of Windows on that machine supports hosting remote desktop at all.

The consumer edition can connect out but cannot accept incoming sessions. If the fresh install ended up on that edition, no amount of credential work will help, and every guide you find will appear to be describing a different machine.

It is a five second check and it explains a surprising share of hours lost to this problem.