This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
People,
Device: [https://www.hp.com/us-en/shop/pdp/hp-elitebook-840-g9-notebook-pc-customizable-4b849av-mb
I have one new laptop HP EliteBook 840 G9 Notebook PC - Customizable which supports Fingerprints and Face Camera running Windows 11 Enterprise Edition.
This feature was working fine as I had successfully enrolled both face recognition and also some fingerprints before I joined the computer to the OnPremise AD Domain.
Active Directory setup: Hybrid Azure AD - Password Hash Sync and Azure AD Connect are in use for the hybrid setup, along with the Azure AD Premium P2.
Problem: After joining the OnPremise AD, Why now the laptop cannot utilize Windows Hello features such as Face recognition and Fingerprinting?
How can I enable both features of windows Hello?
Thank you in advance.
Thank you for your post!
I'm currently looking into your issue and will update as soon as possible.
I'm not too familiar with Windows Hello, but I believe what you initially set up/enrolled in (Fingerprint / Face recognition) was Windows Hello. However, once you domain joined your computer, your domain might need to enable/allow Windows Hello for Business via policy. For more info.
Additional Link: Windows Hello for Business Deployment Prerequisite Overview
Thank you for your time and patience throughout this issue.
I noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
If you have any other questions, please let me know. Thank you!
Hi @JamesTran-MSFT , Thank you for the reply and suggestion, I may have accidentally selected the wrong button :-)
All is good.
Ok, so based on the article that you've shared [https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification I assume there are no additional licensing requirements for the user of Windows 10 / 11 laptop to use Windows Hello biometrics authentication for login?
My Azure AD is Premium P2 with the majority of users on E3 and E5 licenses.
Thank you for following up on this!
I reached out to our Windows Hello for Business team to get more clarification on your issue, and prior to joining your laptop to your on-prem AD, was it already Azure AD joined? If your laptop wasn't Azure AD joined, you were using Windows Hello but not Windows Hello for Business.
If you haven't configured your environment to support Windows Hello for Business (WHFB) authentication, you'll need to meet the prerequisites listed within the Planning a Windows Hello for Business Deployment documentation. For example, if your machine is domain joined, it must be Hybrid Azure AD Joined as one of the key prerequisites for WHFB provisioning.
Additional Link - Enable passwordless security key sign-in to on-premises resources by using Azure AD
I hope this helps!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 56.00000000000001%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHJ%3C/text%3E%3C/svg%3E)
How about when you join AzureAD straight away? Does this work?
Do you have On-Prem GPO's in place? Perhaps these might block Windows Hello?
Hope this helps!
If it does, please accept the answer
Hi @Jelle Hoekstra ,
There is no GPO restricting or turning off Windows Hello from the GPresult.HTML file I just generated on the laptop.
What are the steps so the Azure AD can recognize this new laptop, to allow the Windows Hello feature to work?
Despite numerous restarts and seeing the Local GPO has been enabled like the above, I still cannot use the Biometrics features on all of my laptop users.
Make sure Allow users to log on using biometrics policy is enabled.
More information here: https://www.kapilarya.com/how-to-allow-users-to-log-on-using-biometrics-in-windows-11
Let us know if this helps!
Note: Included link in this reply refers to blog post by a trusted Microsoft MVP.
