Windows 10: Dual enrollment using biometric authentication

Hello


I'm configuring Windows Hello for business for a customer of mine. The customer is very interested to the Dual Enrollment feature logging in with a standard user and "elevating" to an administrative user when needed, so that he does not need to type the password of theirs administrative accounts.


Reading the following article:


https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment


... selecting the privileged user account, and providing their PIN.


and after some testing, it seems that a user can unlock/use the administrative user by typing PIN only, even if he has registered a biometric credential for it.

The customer would like to use fingerprints or face scans to unlock the administrative user on dual enrollment scenario logging in with a standard user and "elevating" to an administrative user when needed.


Is it possibile? If no, are there any plans to do so in the future?

:)

 

biometric devices

Hi,

Thank you for posting your query on Microsoft Community.

I understand your inconvenience. We will assist you to resolve this issue.

I suggest you to follow the methods provided below and check if it helps.

Method 1: Enable Biometric option.

I suggest you to enable the Biometrics to pick up the Biometrics setting. This option shall be enable by default. However, I recommend you to follow the steps provided below and check if it enable or not.

• Press Windows logo key + R key.
• Type gpedit.msc and press
  Enter key.
• Under Computer Configuration, navigate to.

Administrative Templates Windows Components Biometrics

In the left hand panel of the Windows, double click on the following:

• Allow the use of biometrics
• Allow users to log on using biometrics

Select enable option and click on Apply and
OK button.

Now, restart your computer and follow the instructions provided below.

After restarting the computer, I suggest you to disconnect and reconnect the fingerprint sensor device and check if the drivers are getting detected in Device Manager. If the issue still persist, follow method 2.

Method 2: Reinstall drivers and compatibility mode.

I suggest you to download and install the latest drives for fingerprint sensor device from the manufacture’s website and check if it gets detected.

If the issue still persist, you may also install the drivers in compatibility mode and check.

Follow the steps to install the drivers in compatibility mode.

• Download the drivers from the manufacturer’s website.
• Right-click on the installer and click on "Properties".
• Click on the ‘compatibility’ tab and check the box "Run this program in compatibility mode for” and select previous Operating System from the drop down.
• Click on ‘Apply’ and click ‘OK’ and run the file to install it.

After installing the drivers in compatibility mode, follow the method 3 and check if you are able to get the sign in option with Biometric.

Method 3:

• Press Windows logo key + I key.
• Click on Accounts.
• Go to Sign in options.
• The fingerprint option will always be visible if there is a WBF-supported fingerprint reader (and its associated driver) installed on the computer.

For more information, refer the following Microsoft help article.

Biometric Devices

Biometric Devices (Windows Drivers)

Hope it helps. Do let us know if your issue is resolved. For any further query, feel free to contact us.

Thank you.

 

Windows Logon: 2-Factor Biometric Authentication

I have done some reading that Windows10 will incorporate 2-factor authentication.

I was wondering for Windows Logon, does Windows10 support password AND biometric (e.g. fingerprint) authentication? If so, can you provide any feedback on exactly how this is implemented?

Thank you.

 

New Microsoft Authenticator version for Android and iOS - Oct. 12

Two factor authentication (TFA) is easy, convenient, and secure when you use Microsoft Authenticator. Use your phone, not your password, to log into your Microsoft account. Just enter your username, then approve the notification sent to your phone. Your fingerprint, face ID, or PIN will provide a second layer of security in this two step verification process. After youve signed in with two factor authentication (TFA), youll have access to all your Microsoft products and services, such as Outlook, OneDrive, Office, and more.

Microsoft Authenticator version 6.2010.6717 for Android

Source: Microsoft Authenticator - Apps on Google Play




Microsoft Authenticator version 6.4.39 for iOS

Download: Microsoft Authenticator | App Store