How to fix Windows Hello temporarily unavailable error on hybrid devices

Question

How to fix Windows Hello temporarily unavailable error on hybrid devices

Ritesh Sharma 361

I am encountering a Windows Hello error on hybrid devices when trying to log in using a Hello PIN. The policy was pushed from Intune without any issues, and PIN and biometric settings were successfully configured. However, the error message "Windows Hello - That option is temporarily unavailable. For now, please use a different method to sign in" keeps appearing.

This doesn't happen when logging in on Azure AD join devices. What could be causing this issue? Can someone please assist me with a solution?

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2024-01-12T20:04:37.77+00:00

@Ritesh Sharma
I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Accepted answer

1 additional answer

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2024-01-12T20:04:37.77+00:00

@Ritesh Sharma
I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

James Hamil 27,211 Microsoft Employee Moderator

Hi @Ritesh Sharma , This issue can occur when the device is not able to communicate with the on-premises Active Directory Domain Services (AD DS) to verify the user's PIN. To resolve this issue, you can try the following steps:

Verify that the device is properly registered in Azure AD and that the device object is synchronized to the on-premises AD DS. You can check this by running the following command in PowerShell: Get-ADComputer -Identity <computername> -Properties *. Replace <computername> with the name of the computer you are checking.
Verify that the device is properly configured for Hybrid Azure AD join. You can check this by running the following command in PowerShell: dsregcmd /status. The output should show that the device is joined to Azure AD and that the AzureAdPrt token is present.
Verify that the device is able to communicate with the on-premises AD DS. You can check this by running the following command in PowerShell: Test-ComputerSecureChannel -Verbose. The output should show that the secure channel is established.
Verify that the device is able to communicate with the domain controller that holds the Primary Domain Controller (PDC) emulator role. You can check this by running the following command in PowerShell: nltest /dsgetdc:<domainname> /pdc. Replace <domainname> with the name of your domain.

If all of the above steps are successful, you can try resetting the Windows Hello for Business PIN on the affected device. You can do this by following these steps:

Open the Settings app on the affected device.
Click on "Accounts" and then click on "Sign-in options".
Under "Windows Hello PIN", click on "I forgot my PIN".
Follow the prompts to reset your PIN.

If you still encounter issues please let me know and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Ritesh Sharma 361 Reputation points

2024-01-25T12:16:10.0966667+00:00

@James Hamil thanks for your reply. We find that certificate trust was not establish. Which require to work Windows Hello for business in Hybrid environment. We are working towards that to fix it.
Stefano Zazzero 5 Reputation points

2024-01-25T16:52:04.83+00:00

Hi James, I have the tame issue starting when some PC become Hybrid joined, with only AD on-prem and the GPO for Hello for Business everithing was working fine, all your test described before are running fine.

Thanks Stefano
John Eliav 15 Reputation points

2024-03-28T14:28:03.75+00:00

I seem to still have an issue after following your steps. my device is properly hybrid joined. all the commands checked out. I was able to reset my pin, but still getting the same error when trying face ID or pin
afar 30 Reputation points

2024-04-10T15:18:47.93+00:00

Same thing here. All looks OK in above tests. No error on sign in options pages. Nothing (face, fingerprint, PIN) works except full password. No errors in event viewer > WHFB operational logs.

Any further ideas @James Hamil ?
Brent Mammen 0 Reputation points

2024-04-17T16:46:04.0766667+00:00

Same - everything checks out but I'm receiving the "That option is temporarily unavailable" & "Something went wrong. Try again later" errors for Face, Fingerprint, and PIN.
Craig Walters 0 Reputation points

2024-05-29T04:11:22.2233333+00:00

Same issue here. Been trying to get this working correctly for months
Ritesh Sharma 361 Reputation points

2024-05-29T08:20:45.9466667+00:00

Hi All, i managed to fix the issue by enabling cloud Kerberos trust in my environment to fix. It is require if devices are joined as Hybrid.

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust?tabs=intune
Brent Mammen 0 Reputation points

2024-05-29T13:47:51.3866667+00:00

We've had the Cloud-trust model enabled for some time and this issue, for us, is unrelated. Our machines show "Cloud trust for on premise auth policy is enabled: Yes"
shiva boodoo 0 Reputation points

2025-01-08T14:43:33.65+00:00

I have the same issue. I tried all the steps and got the same issue
Antonio Longo 0 Reputation points

2025-06-26T14:18:08.6466667+00:00

my issue Summary: Hybrid Azure AD Join with MDM enrollment via Microsoft Intune.

Cloud Kerberos Authentication: Enabled

Windows 11 Devices: Sign-in using Windows Hello for Business is successful

Windows 10 Devices: Sign-in fails with the error: “That option is temporarily unavailable. For now, please use a different method to sign in.”

Answer 2

Muhammad Safeer Saqib 6

nltest /dsgetdc:<domainname> /pdc status: Error 1355 0x54b Error no such domain facing this error could you help on this

Share via

How to fix Windows Hello temporarily unavailable error on hybrid devices

1 additional answer

Your answer