Just some background here first. We have a hybrid setup, AD and AAD using Azure AD Connect. Windows Hello for Business Cloud Trust has been set up and working fine. However, for whatever reason, some users sometimes are not able to sign in to Windows with either a PIN or fingerprint. Since we enforced users by Conditional Access to sign in with phishing-resistant methods which are either PIN or Fingerprint in order to be able to connect the Palo Alto VPN to our Head Office, they will not be able to connect VPN if they are not signing in to with either of the methods. One morning, a user's registered PIN and fingerprint in Windows 11 suddenly were not working. He managed to sign in with a password first and reset his PIN successfully. He then tried to re-register his fingerprint by successfully removing the current one inside the Sign-in Options dialog. However, when he tried to start the fingerprint setup to register the same finger he used before, he kept getting this message " Sorry, something went wrong. That fingerprint is too similar to one that's already set up. Try a different finger." he wanted to use the same finger. So, we removed all the .dat files inside C:\Windows\System32\WinBioDatabase while the Windows Biometric Service was stopped and then started the service, then had him do the fingerprint setup again. Unfortunately, he still encountered the same message " Sorry, something went wrong. That fingerprint is too similar to one that's already set up. Try a different finger." Would that be caused by the initial removal of his fingerprint while the VPN was not connected so that a copy of the previously registered fingerprint ID still existed in the Azure AD?
Is there an ultimate solution to reset his biometric setup so that he can register his same index finger?
CS