Microsoft Security | Intune | Configuration
Setting up and managing device configurations using Intune
Hello Tom
Windows Hello have to apply to users not to devices.
Removal of Windows Hello for Business
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 78%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETW%3C/text%3E%3C/svg%3E)
Tom Wrigglesworth
125
Reputation points
Hi all,
We are looking to get WHfB off the ground using Intune. We have a varriety of laptops in our estate, some are compatible and some aren't.
I have made 2 policies in Intune, one to enable and one to disable (for the older devices).
I've added my machine to the disable group but Windows Hello is still giving the option to setup and a PIN prompt on the logon page.
Is there a bit i'm missing?
Any help is welcomed :)
Microsoft Security | Intune | Configuration
Windows for business | Windows Client for IT Pros | User experience | Other
Answer accepted by question author
Answer accepted by question author
-
glebgreenspan 2,255 Reputation points2024-01-05T13:22:29.87+00:00 -
Tom Wrigglesworth 125 Reputation points
2024-01-05T13:26:15.9066667+00:00 Is there a way to exclude devices? - we have shared PCs that aren't compatible with WHfB
-
glebgreenspan 2,255 Reputation points
2024-01-05T13:53:15.45+00:00 Yes, you can do that.
Group Policy Method: - Open the Group Policy Editor by pressing Windows Key + R, then typing "gpedit.msc" and hitting Enter. - Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Windows Hello for Business". - Look for the policy setting named "Use Windows Hello for Business" and double-click on it. - Select the "Disabled" option to turn off Windows Hello for Business. - Apply the changes and close the Group Policy Editor
Registry Method: - Press Windows Key + R, then type "regedit" and press Enter to open the Registry Editor. - Navigate to the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System- Look for the registry entry named "AllowDomainPINLogon" or "AllowDomainPINLogonWithActiveProtection" (depending on your Windows version). - Right-click on it, select "Modify", and set the value to "0" to disable Windows Hello for Business. - Close the Registry Editor.After either of these methods, the devices will be excluded from using Windows Hello for Business. However, keep in mind that these settings will be applied to the entire device, affecting all users.
But also, please check with a company regulation about face recognition, from my experience it's too complicated to use that.
-
glebgreenspan 2,255 Reputation points
2024-01-05T13:56:56.66+00:00 You can do that
1.Group Policy Method: - Open the Group Policy Editor by pressing Windows Key + R, then typing "gpedit.msc" and hitting Enter. - Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Windows Hello for Business". - Look for the policy setting named "Use Windows Hello for Business" and double-click on it. - Select the "Disabled" option to turn off Windows Hello for Business. - Apply the changes and close the Group Policy Editor.
2.Registry Method: - Press Windows Key + R, then type "regedit" and press Enter to open the Registry Editor. - Navigate to the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System- Look for the registry entry named "AllowDomainPINLogon" or "AllowDomainPINLogonWithActiveProtection" (depending on your Windows version). - Right-click on it, select "Modify", and set the value to "0" to disable Windows Hello for Business. - Close the Registry Editor.After either of these methods, the devices will be excluded from using Windows Hello for Business. However, keep in mind that these settings will be applied to the entire device, affecting all users.
Sign in to comment -