Primitive root in a finite field Wen-Her Yang and Shiuh-Pyng Shieh proposed two password authentication schemes by employing smart cards, one is timestamp-based and the other one is nonce-based. Their scheme consists of 3 phases: Registration, login and authentication phase. 

Considering timestamp-based scheme, step 3 of registration phase says:


  Find an integer $g$ which is a primitive element in both $\operatorname{GF}(p)$ and
  $\operatorname{GF}(q)$, where $g$ is the system's public information.


What happens if we use a $g$ that is not a primitive element of those two fields? How can this affect scheme security?

I myself think that by selecting a $g$ that is not a primitive element, we end up using a smaller group which probably can make things easier for an attacker to solve discrete logarithm problem $h_i=g^{\mathit{pw}_i\cdot d}$ and obtain $\mathit{pw}_i\cdot d$.
You're right. In general if a $g$ is not a primitive element of $\operatorname{GF}(p)$ it generates a smaller subgroup of $\operatorname{GF}(p)^{\ast}.$ Since $|\operatorname{GF}(p)^{\ast}|=p-1$ is divisible by 2, this subgroup can be as small as 2 in size, and its size can take on any value $w,$ where $w \mid (p-1).$