Windows Hello Issue

Question

Hello,

I’m currently encountering an issue with configuring Windows Hello for domain-joined users. When a user attempts to sign in using their PIN, the following error message appears: “Your credentials could not be verified.”

A Group Policy Object (GPO) has been configured to enable Windows Hello, as shown in the table below. The environment is hybrid, consisting of a Microsoft 365 tenant and two synchronized Active Directory domain controllers (Windows Server 2025). An Active Directory Certificate Services (AD CS) infrastructure is also in place.

 

Group Policy Path	Group Policy Setting	Value
Computer Configuration\Administrative Templates\Windows Components\Windows Hello for BusinessorUser Configuration\Administrative Templates\Windows Components\Windows Hello for Business	Use Windows Hello for Business	Enabled
Computer Configuration\Administrative Templates\Windows Components\Windows Hello for BusinessorUser Configuration\Administrative Templates\Windows Components\Windows Hello for Business	Use certificate for on-premises authentication	Enabled

 

 

Thank you in advance for your support.

Answer 1

Hello Loris,

Thank you for posting question on Microsoft Windows Forum.

Based on the error message "Your credentials could not be verified**" .** It is probably of that the issuing Certificate Authority (CA) certificate is missing in the NTAuth store of the domain controller and client machine.

When you use WHFB, the domain controller needs to validate the certificate sent by the client machine. During the validation, it checks the Key Distribution Center (KDC) service on the domain controller to verify if it can find the issuing CA certificate in the NTAuth registry key. The NTAuth registry key locates at HKLM\Software\Microsoft\EnterpriseCertificates\NTAuth\Certificates.

You can follow the instruction of below article to fix the issue.

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/your-credential-could-not-be-verified-error-when-logging-on-to-windows-by-using-whfb

Hope the above information is helpful