Windows 10: Windows Hello for Business vs Windows Hello and what are the requirements?

Hello We have 2012 Domain Controllers in our corporate environment, due to a lot of legacy servers on premise. Are 2016 DCs an absolute requirement?Ms documentation says no apart from hybrid cloud kerberos, but key and certificate are supported with older DCs, HOWEVER:Attribute msDS-KeyCredentialLink is only available if you have 2016 DCs.We definitely do not want to use ADFS.https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust https://msendpointmgr.com/2023/03/04/cloud-kerberos-trust-part-1/#key-trust If you need 2016 DCs, do you

:)

 

Windows Hello vs Hello for Business?

I’m sure for a consumer it’s impossible to setup Hello for Business since it’s dependent on a certificate based authentication vs using just the Hello which uses a convenience PIN, which is a bit less secure than Hello for Business. And plus, Hello for Business requirements are that a pc needs to be joined to Azure AD which a home user account cannot accomplish. Is it still good idea for a consumer like me on a Standalone pc to use just the convenience PIN to login to Windows?

 

Windows Hello vs Hello for Business?

My best advice is to just use a regular password like we did back in the XP days. I see so many problems posted about PIN numbers, Windows Hello, etc... that it's just not worth the hassle.

 

Can't disable Windows Hello for Business

I receive this error in Event Viewer whenever I boot Windows 10 Pro version 1709 build 16299.309.

Windows Hello for Business provisioning will not be launched.

Device is AAD joined ( AADJ or DJ++ ): Not Tested

User has logged on with AAD credentials: No

Windows Hello for Business policy is enabled: Not Tested

Local computer meets Windows hello for business hardware requirements: Not Tested

User is not connected to the machine via Remote Desktop: Yes

User certificate for on premise auth policy is enabled: Not Tested

Machine is governed by none policy.

See Windows Hello for Business cloud Kerberos trust deployment guide for more details.

I tried the following suggestion:

"Type gpedit.msc Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Passport for Work OR Windows Hello for Business Edit "Use Microsoft Passport for Work" OR "Use Windows Hello for Business" and set it to disabled."

I checked the registry and \HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork Enabled is set to 0.

I am using the Administrator account.

The error continues at every bootup.

Thank you.