How do I disable Windows Hello requirement when not using Intune?

Question

How do I disable Windows Hello requirement when not using Intune?

Robert Willadsen 70

We are getting set up with a third party MDM solution to manage our Windows machines. After going through OOBE on a Windows 11 device and signing in with an Entra ID account to join the device and enroll in MDM, I am prompted to "Use Windows Hello with your account" and set up a pin. This also happens any time I sign in with a different user on this device, or sign in on another machine that's joined to Entra ID. The only instructions I can seem to find regarding disabling Windows Hello point me to instructions for Intune. I've also reached out to support for our MDM tool, and they say this isn't something controlled by them. How do I disable this as a requirement?

Andrew Allston 15 Reputation points

2024-02-28T22:09:21.6+00:00

Sounds like the selected MDM isn't up to the task of managing Windows clients. Most can, so maybe this MDM is not the right choice.

Even if they don't support that particular CSP (Not sure how if they support windows at all) you should still be able to push scripts or registry entries to the host. Just Bing how to disable Windows Hello with powershell or the registry.

The only other option I can think of, without weird 3rd party stuff would be a classic GPO if they are domain joined clients.
Robert Willadsen 70 Reputation points

2024-02-29T14:28:02.0033333+00:00

Thank you. The MDM is IBM MaaS360. The only thing I see related to Windows Hello in their policies is already not enabled, and after putting in a ticket with support they said "our current Windows Policy features do not support in blocking it." They recommended Group Policy Editor, but stated it was out of scope for them. I guess I'll just have to look into using a script.

Answer accepted by question author

0 additional answers

Your answer

Andrew Allston 15 Reputation points

2024-02-28T22:09:21.6+00:00

Sounds like the selected MDM isn't up to the task of managing Windows clients. Most can, so maybe this MDM is not the right choice.

Even if they don't support that particular CSP (Not sure how if they support windows at all) you should still be able to push scripts or registry entries to the host. Just Bing how to disable Windows Hello with powershell or the registry.

The only other option I can think of, without weird 3rd party stuff would be a classic GPO if they are domain joined clients.
Robert Willadsen 70 Reputation points

2024-02-29T14:28:02.0033333+00:00

Thank you. The MDM is IBM MaaS360. The only thing I see related to Windows Hello in their policies is already not enabled, and after putting in a ticket with support they said "our current Windows Policy features do not support in blocking it." They recommended Group Policy Editor, but stated it was out of scope for them. I guess I'll just have to look into using a script.

Answer 1

glebgreenspan 2,255

Hello Robert

This should help you

Group Policy or Registry Settings:

If your organization has access to Group Policy or Registry settings, you can disable the Windows Hello PIN requirement through these settings. Here are the steps:
Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business.
Double-click on "Use Windows Hello for Business" policy and set it to "Disabled."

Robert Willadsen 70 Reputation points

2024-03-05T20:41:51.36+00:00

Thank you. I am trying to set this up for EntraID Joined machines, so no GPO capability from our local AD domain, but I found the registry key for this setting and it is working. At least for subsequent logins on a machine. The only thing I can't figure out is how to apply this during OOBE. It still tells me that Windows Hello for Business is required by my organization during OOBE, so I can't get around needing to configure it for the first user that sets up a fresh device. If it is an organizational requirement, as an admin, I would think I should have the ability to remove the requirement.
Szymon Puszkar 1 Reputation point

2024-05-22T18:20:50.24+00:00

Hi i have other problem i set WHfB to Enable in gpedit and now i cannot login with admin account coz win10 say " You need to use windows hello function or smart card to log in" but i didnt set any face, PIN, fingerprint and i dont have any smart card :/

Share via

How do I disable Windows Hello requirement when not using Intune?

0 additional answers

Your answer