Microsoft 365 User has Windows Hello Facial Recognition Enabled by Force, Doesn't Have it Set Up Under Sign-In Options

Question

As the title suggests, a User at the company I work at, has Windows Hello Facial Recognition enabled for login. However, he uses the PIN as his method and wanted it disabled. I provided him the usual methods of removing it. Going in to the Settings and removing the face login, set the default sign-in option to PIN, but to no avail. He will still get a prompt to sign in using facial recognition first before switching to PIN.

I have done several steps already:

• Setting up Facial Recognition, then removing it.
• Checking Lock Screen personalization.
• Uninstalling Facial Recognition (Windows Hello) Software Device Driver under Biometric Devices in Device Manager.
• Disabling Access on Camera (Settings, Surface).
• Disabling Camera.

I would continue on with further steps, but alas, I lack the access/authority to proceed. I have my manager looking into it currently, but the User in question seems to be the only one with this issue.

Any ideas as to what would cause Windows to use forcefully use Windows Hello Facial Recognition over everything despite not being set up? Any idea helps.

Information of Device/User:

Microsoft 365 Environment

Device: Microsoft Surface Laptop 5

OS: Windows 11 Enterprise

User has other computers he uses

***moved from Windows / Windows 11 / Accounts, profiles, and login***

Answer 1

Hello Brandon.AVW,

Thank you for posting in Microsoft Community forum.

It sounds like the user is experiencing an issue where Windows Hello Facial Recognition is prioritized over the PIN sign-in method, despite attempts to disable it. Here are a few troubleshooting steps that might help resolve the issue:

Based on the description "but the User in question seems to be the only one with this issue", please check if the problem is related to only this account or only this machine.

1.Check Windows Hello Group Policy Settings:

Open the **Group Policy Editor** by typing gpedit.msc into the Run dialog (Win + R).

Navigate to **Computer Configuration -> Administrative Templates -> Windows Components -> Windows Hello for Business**.

Look for a policy named **"Use Windows Hello for Business"** and ensure it's set to **"Disabled"** if you want to prevent Windows Hello biometric options entirely.

2.Remove Biometric Data:

Go to **Settings -> Accounts -> Sign-in options**.

Even if the facial recognition option doesn't appear to be set up, look for an option to **Remove** the facial recognition data.

You may also want to delete any stored biometric data via the Biometric Devices in **Device Manager**:

Open **Device Manager** (Win + X, then select Device Manager).

Find **Biometric Devices**, right-click on your device, and select **Uninstall Device**.

Restart your computer afterward.

3.Reset PIN Configuration:

Go to Settings -> Accounts -> Sign-in options:

Under PIN (Windows Hello), choose **Remove** to delete the existing PIN.

After the PIN is removed, reboot the computer and then set up a new PIN.

4.Registry Tweak (Advanced):

Open the **Registry Editor** by typing regedit in the Run dialog (Win + R).

Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Settings\AllowSignInOptions.

Ensure that entries here are configured correctly. Setting the key to 0 should disable Windows Hello options.

Be very cautious when making changes to the registry (please back up the registry before you make changes).

5.Firmware or BIOS Settings:

Some laptops and desktops allow for biometric settings to be configured or disabled directly within the BIOS or UEFI firmware settings. Restart the computer and enter the BIOS/UEFI settings (usually by pressing F2, Del, Esc, or another key during the startup sequence) and look for security or biometric settings to disable facial recognition.

6.If there is no such problem in the past and the problem occurs suddenly, please check if you made any change on this machine recently.

7.Compare the settings between the working and non-working machines.

If these steps do not resolve the issue, you may need to look into more specific company policies or settings that might be enforced via your organization's IT management solutions (like Intune, SCCM, etc.).

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou

Answer 2

Hey, Daisy.

Sorry for the radio silence.

I (and by extension, the team here) will give these a try. The User is quite busy and is hard to get with his current availability.

My boss did point out that the User's device is a bit wonky (bugs, missing features, etc.), so there is that to consider, as well.

I will provide an update at some point next week when we have worked with the User.

Thank you for your patience and to those who paid a visit to this post looking for an answer..

Regards,
Brandon A.

Answer 3

Hello

Greetings!

OK. Have a nice day!

Best Regards,
Daisy Zhou

Answer 4

Hey, Daisy. And anyone reading this.

Unfortunately, the tech that was working on this with the User ended up just swapping the laptop. I am not sure if he has wiped the computer. If he hasn't great, I'll probably ask him to leave it running for me to mess with. If he did, then that is tough.

I appreciate you helping me Daisy with this. Wish I could have pushed these methods to see if they worked or not.

Thanks again and take care.

Regards,
Brandon A.

Answer 5

Hello

Greetings!

Thank you for your update and time.

Have a nice day!

Best Regards,
Daisy Zhou