How do I Remove an Old Device from windows security passkey prompt?

Okay, So I managed to add my phone again but it's coming up as a duplicate?? and it errors out (the error on my phone says try another verification open error 105) on my phone when trying to use it. I assume this is because the the old phone entry. I see my newer phone passkey on my account page but I don't see the one that.

here is a screenshot of my security page showing the NEW passkey from my phone and my yubikey but the other one is missing:

Here the screenshot from the prompt now. I need to remove the one with a red circle. the blue circle is the new key seen in the previous screenshot:

Looks like you may need to use the Windows 11 Phone Link app to remove the old Pixel phone device, which should remove it as an option to authenticate as well.

You can just search for the Phone Link app, it displayed on my Windows 10 device even though it indicates you must have a Windows 11 device to link the Android phone (which I do have linked the old way with Windows 10).

Rob

This is unrelated to Phone Link, but for the heck of it I tried it anyway, and it didn't work. There is still a ghost Device associated with my MS account. super annoying because I can't use passkeys on my pc at all on any site until It gets fixed.

Welp, It just happened again, I attempted to delete the new one and got an error "Security key could not be removed at this time" but it removed it from the account page. and now i have another Phantom security key that doesn't exist. Can someone from Microsoft chime in here please?

I just had this question and I've found that this is stored in the registry, as keys under
HKEY_USERS\S-1-5-20\Software\Microsoft\Cryptography\FIDO\(Account SID)\LinkedDevices

I've successfully cleaned up my list (and renaming devices in it) by modifying entries under this key.
I haven't been able to find any UI to manage this, so registry editing it is for now.

Panic.exe,

After searching for both Microsoft specific and 3rd-party (Google) methods for dealing with a lost device, which is fundamentally what you've got since the private key previously associated with the factory reset phone is now lost, it appears that as I was just beginning to suspect, it's the keys associated with that previous private key that need to be deleted rather than the phone itself.

What I mean by this is that just like when an actual FIDO2 physical key is deleted, you'd apparently need to delete the Microsoft services (login.Microsoft.com) key associated with that legacy device.

The question this leaves is where is that information stored? Is it local to the device as it appears from the ghost Pixel 6 Pro device present in Windows Security or is it actually stored elsewhere?

While writing this, the thought process got me thinking about the supposed sync support Google provides for its own passkeys and whether you personally were actually using the Microsoft Authenticator as I do or possibly the built-in support for passkeys now found on current Google Android phones.

I'm not certain precisely how Microsoft is supporting passkeys with their Authenticator at present and whether these are part of the backup of that data or not.

However, it you simply used the built-in Google support for passkey storage, then the passkeys associated with that phone from Google's standpoint are actually managed from their own interface by logging into your Google account, Security, Passkeys or "Manage all devices" described in the Remove or opt out of passkeys section of the following Google Support document.

Sign in with a passkey instead of a password - Google Account Help

Now based on the Google method for doing this, it does appear that the devices option for removing these is missing from the Windows Security interface. However, the apparent lack of what I'd expect to be many more issues like yours (there are a few, but a tiny handful that I've found) means we may simply be looking in the wrong place or for the wrong set of steps.

You may want to try and reach Microsoft Support directly, since these forums are a consumer community and manned by volunteers or contract workers, so no true support personnel will ever see this thread. There are methods to force the automated processes Microsoft uses to bring you here to offer an option to request a call from Support instead, though I've never used them and thus don't know the correct path.

I'd think this would be far easier than it appears, but that's why I often can't find these myself, since I have a specific idea how they should work and just plain miss the obvious selection that actually works. But without a supported Windows 11 system to test, I can't see all the options available to you.

Rob

Hi, how to tell this registry is the exact registry related to the device I wanna remove?

Has anyone gotten a real fix to this ridiculous Screw up? Microsoft and Google keep pointing to each other... for an old device passkey that no one can delete if they got rid of the physical Android device... Talk about a HUGE Security risk of NOT being able to DELETE a PassKey...

Panic,

I thought you took a screenshot of my pc! I have the EXACT Pixel 6 Pro stuck in here too. Doesn't even register my new Pixel 8 Pro even after using Phone Link.

Have you found an actual solution to this? This is the kind of stuff that makes me not trust passkeys on Windows! Meaning...it's not transparent about where the keys are all stored.

Panic,

I thought you took a screenshot of my pc! I have the EXACT Pixel 6 Pro stuck in here too. Doesn't even register my new Pixel 8 Pro even after using Phone Link.

Have you found an actual solution to this? This is the kind of stuff that makes me not trust passkeys on Windows! Meaning...it's not transparent about where the keys are all stored.

nothing, however retired MSrs have been stating no body @ microsoft helps/cares about these things or this site... This site is just a honeypot for MS misfits. Welcome to our hell... Just know everyone ends up here, some sooner than others.