Windows Hello for Business fallback configuration

Question

Windows Hello for Business fallback configuration

testuser7 206

Hello,

In case of Windows-Hello for Business signing into the laptop, we know that we can use biometrics like Fingerprint

If for some reason if the fingerprint reader is not accepting my already enrolled fingerprint then after couple of failed attempts I will be asked to put the PIN

Basically PIN is a fallback plan.

I would like to know, is there any way I can turn off the fallback method.
Of course user will be left out in such case.

Thanks.

JamesTran-MSFT 29,631 Reputation points Microsoft Employee

2022-12-09T23:22:03.087+00:00

@testuser7
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

JamesTran-MSFT 29,631 Reputation points Microsoft Employee

2022-12-09T23:22:03.087+00:00

@testuser7
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 1

JimmySalian-2011 31,901

Hi testuser,

I do realise your setup and hence I requested you to test on a single devices. However disabling is not recommended as per Microsoft as this will disable the Biometrecis too.

Goodluck my friend.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.

testuser7 206 Reputation points

2022-11-13T15:21:59.593+00:00

Thanks @JimmySalian-2011

Yes, this helps.
Looks like msft will never disable pin and it makes sense too.

But that also means that there is no extra security we are getting by buying advance infrared camera integrated device for example, because all that the imposter requires is to get your pin.

Right ?
JimmySalian-2011 31,901 Reputation points

2022-11-13T17:18:33.513+00:00

Hi,

No that is incorrect and the way PIN is secured is not easy to hack or get access to that via normal methods and Microsoft has taken extensive care to secure this including PIN brute-force attacks if you are OnPremise it is in the TPM chip and encrypted, if it is Azure AD joined it is stored safely and with MFA double layer protection.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.
testuser7 206 Reputation points

2022-11-14T19:12:03.427+00:00

Yup, it is a perspective thing. But you are right about PIN
JimmySalian-2011 31,901 Reputation points

2022-11-16T15:54:28.34+00:00

If the answer was helpful, Please Accept the answer if the information helped you. This will help us and others in the community as well.
JamesTran-MSFT 29,631 Reputation points Microsoft Employee

2022-11-18T19:05:03.163+00:00

@testuser7
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

JimmySalian-2011 31,901

Hi,

I think you can try this GPO settings:

1.Navigate to Computer Configuration -> Administrative Templates -> System -> Logon
2.Set the Turn on convenience PIN sign-in policy to Disabled, Apply.

Try this one a single PC for a test and see how it goes.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.

testuser7 206 Reputation points

2022-11-13T14:43:09.663+00:00

Thanks @JimmySalian-2011

You realized that we are not talking about windows hello convenience signin.

This is full azure-ad joined device enrolled into windows hello for business.

Do you still think convenience pin turn off will help ??

Windows Hello for Business fallback configuration

2 answers

Activity