Windows Hello for Business Hybrid Cloud Trust Deployment Error

Question

Hello,

I am in the process of setting up Windows Hello for Business for my company and I am utilizing the Cloud Kerberos Trust method for a hybrid environment.

The Issue:

My test user can register a windows hello method when prompted by their login, however they cannot use that windows hello method on subsequent logins. When they attempt to do so they get the following error message:

“Your Credentials could not be verified” followed by “Something went wrong and your PIN isn’t available (Status:0xc000006d, substatus: 0xc000000d0). Click to setup your PIN again.” (On some attempts the status code of: 0xc000006bb, was observed)

The button below this message “Set up my PIN” does not lead anywhere, and does not allow for a PIN setup. The user can still login with their password.

Actions I have taken to Troubleshoot:

I have verified my settings against this guide: Windows Hello for Business cloud Kerberos trust deployment guide | Microsoft Learn

I have tried using both a fully updated and Intune compliant windows 10 and windows 11 machine in testing. Both yield the same results.

I have attempted setting up Whfb, through Intune Settings Policy and Intune Endpoint Security Account Protection Policy.

I have verified that the created cloud Kerberos AD object has permission to talk to test computers. I also verified that each test computer could ping the domain controller and vice vs.

Environment:

Server Datacenter 2019 – DC OS
Question:
Can anyone tell me what I am doing incorrectly? is there any supporting information that would make this more clear?

Answer 1

Hi Tristan,

Recreate AzureADKerberos Object: If the AzureADKerberos object has permission issues, remove and recreate it using Powershell:

Remove-AzureADKerberosServer -Domain $domain

Set-AzureADKerberosServer -Domain $domain -UserPrincipalName $adminUPN

Policy Configuration Fix: Ensure only one Windows Hello for Business policy applies to the device. In Intune, configure the policy with "Use Cloud Trust = Enabled" and "Use certificate for on-premises authentication = Disabled".

Network Connectivity Resolution: Implement Always-On VPN or ensure reliable domain controller connectivity during authentication attempts. The device must maintain network access to both Azure AD and on-premises domain controllers.

Certificate Validation Issues: For Windows Server 2019 domain controllers, ensure the domain functional level supports the authentication method. Some authentication failures occur due to certificate validation issues in mixed-mode environments.

User Object Synchronization: Verify that user objects have proper on-premises SAM account name and domain name synchronized through Azure AD Connect. Missing or incorrect synchronization can cause authentication failures.

Service Account Permissions: Grant the AzureADKerberos computer object "Log on as a service" rights and ensure it has proper delegation permissions in Active Directory. The object requires specific permissions to act as a Kerberos authentication proxy.

Monitoring and Alerts: Implement monitoring for Event ID 4625 (logon failures) with status 0xc000006d to detect authentication issues early. Regular monitoring helps identify connectivity or configuration problems before they affect users.

=================================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.