Windows 10: Enable or Disable Domain Users Sign in to Windows 10 using Biometrics

How to: Enable or Disable Domain Users Sign in to Windows 10 using Biometrics

How to Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics


Windows Hello biometrics lets you sign in to your devices, apps, online services, and networks using your fingerprint.

For more information about Windows Hello, see:

• Windows Hello and privacy | Microsoft privacy
• Windows Hello | Microsoft Docs
• Windows Hello biometric requirements | Microsoft Docs
• Windows Hello - UWP app developer | Microsoft Docs
• Making Windows 10 More Personal and More Secure with Windows Hello - Windows Experience Blog
• Windows Hello biometrics in the enterprise (Windows 10) | Microsoft Docs

By default, users with a elevate UAC permissions using biometrics unless disabled via policy.

This tutorial will show you how to enable or disable allowing domain users to sign in to Windows 10 using biometrics.

*note This policy will not effect local users to sign in using biometrics.

*Warning You must be signed in as an administrator to enable or disable allowing domain users to sign in using biometrics.


CONTENTS:

• Option One: Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics in Local Group Policy Editor
• Option Two: Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics using a REG file

OPTION ONE [/i] Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics in Local Group Policy Editor

*note The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Two below.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\Windows Components\Biometrics




3. In the right pane of Biometrics in Local Group Policy Editor, double click/tap on the Allow domain users to log on using biometrics policy to edit it. (see screenshot above)

4. Do step 5 (enable) or step 6 (disable) below for what you would like to do.


5. To Enable Domain Users to Sign in to Windows 10 using Biometrics
A) Select (dot) Not Configured or Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

*note Not Configured is the default setting.

6. To Disable Domain Users to Sign in to Windows 10 using Biometrics
A) Select (dot) Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)




7. When finished, you can close the Local Group Policy Editor.





OPTION TWO [/i] Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics using a REG file

*note The downloadable .reg files below will add and modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider

Domain Accounts DWORD

0 = Disable
1 = Enable


1. Do step 2 (enable) or step 3 (disable) below for what you would like to do.


2. To Enable Domain Users to Sign in to Windows 10 using Biometrics
*note This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Enable_domain_users_to_sign_in_using_biometrics.reg

Download

3. To Disable Domain Users to Sign in to Windows 10 using Biometrics
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Disable_domain_users_to_sign_in_using_biometrics.reg

Download
4. Save the .reg file to your desktop.

5. Double click/tap on the downloaded .reg file to merge it.

6. When prompted, click/tap on Run, OK (UAC), Yes, and OK to approve the merge.

That's it,
Shawn


Related Tutorials

• How to Enable or Disable Windows Hello Biometrics in Windows 10
• How to Enable or Disable Users to Sign in to Windows 10 using Biometrics
• How to Join a Windows 10 PC to a Local Active Directory Domain
• How to Remove a Windows 10 PC from a Local Active Directory Domain
• How to Enable or Disable Domain Users to Sign in with PIN to Windows 10
• How to Enable or Disable Domain Users to Sign in with Picture Password to Windows 10
• How to Enable or Disable Users to use Companion Device to Sign in to Windows 10
• How to Add or Remove a Fingerprint for your Account in Windows 10
• How to Set Up Windows Hello Face Recognition in Windows 10
• Enable Enhanced Anti-Spoofing for Windows Hello Face Authentification in Windows 10
• How to Remove Your Face from Windows Hello in Windows 10
• How to Improve Windows Hello Face Recognition in Windows 10
• How to Turn On or Off Automatically Dismiss Lock Screen for Windows Hello Face in Windows 10
• How to Enable or Disable Show Local Users on Sign-in Screen on Domain Joined Windows 10 PC

:)

 

How do I re-enable PIN + Fingerprint sign-in for domain PCs?


A previous GPO tech set these to be disabled by default and I can't figure out how to re-enable. The options stay greyed out no matter what I try. I don't want to remove the settings to disable from the default policy so I have created an additional GPO for certain PCs to have it enabled and I'm just trying to find all of the settings to get this working again for the approved users.

This is what I have set currently...
In Computer -> Policies -> Admin Templates:
System/Logon -> Turn on PIN sign-in = Enabled
Windows Components/Biometrics -> Allow domain users to log on using biometrics = Enabled
Windows Components/Biometrics -> Allow users to log on using biometrics = Enabled
Windows Components/Biometrics -> Allow the use of biometrics = Enabled
Windows Components/Microsoft Passport for Work -> Use biometrics = Enabled
Windows Components/Microsoft Passport for Work -> Use Microsoft Passport for Work = Enabled

Any suggestions are most welcome

Thanks

 

Biometric - Window Hello (FingerPrint/Facial), Not showing main login

Hello @marlvill, *Smile

If you haven't already, double check the Allow domain users to log on using biometrics group policy below to make sure it hasn't been disabled by mistake.

*Arrow Enable or Disable Domain Users Sign in to Windows 10 using Biometrics | Windows 10 Tutorials

 

Cant enable windows hello with fresh install of anniversity upgrade on domain account

Hello,

as the title said.

it was working fine with earlier version of windows 10, but with the new upgrade its not possible.

local account working fine.

what i tested:

copied new admx from the win 10 anniversitey upgrade install to gpo policy store.

enabled the following gpos for my computer + user account:

Policy
Setting
Comment

Allow users to select when a password is required when resuming from connected standby
Disabled

Show first sign-in animation
Disabled

Turn off picture password sign-in
Enabled

Turn on convenience PIN sign-in
Enabled

Windows Components/Biometricshide

Policy
Setting
Comment

Allow domain users to log on using biometrics
Enabled

Allow the use of biometrics
Enabled

Allow users to log on using biometrics
Enabled

Windows Components/Windows Hello for Businesshide

Policy
Setting
Comment

Use a hardware security device
Enabled

Use biometrics
Enabled

Use Windows Hello for Business
Enabled

but still, its like the gpo doesn1T even applied, picture login enabled, rest is disabled.

I'm missing something ? or there is an issue with the admx file ?

Thanks

 

Biometrics (facial recognition) not working on domain - driving me crazy!

Hi,

It is a Creative Labs BlasterX Senz3D webcam which works fine with the Intel SR300 drivers.

I have tried removing the computer from the domain, at which point the webcam works perfectly for facial recognition. So that rules out the webcam being the cause of the problem. When I re-join the computer to the domain, it refuses to work for facial recognition
although of course does continue working in things like Skype etc and all three drivers (Depth, RGB, Virtual) continue to show up in Device Manager.

I have tried turning on the following settings: in Group Policy:

Computer/AdministrativeTemplates/System/Logon/Turn on PIN sign-in

Computer/AdministrativeTemplates/WindowsComponents/Biometrics/Allow the use of biometrics

Computer/AdministrativeTemplates/WindowsComponents/Biometrics/Allow users to log on using biometrics

Computer/AdministrativeTemplates/WindowsComponents/Biometrics/Allow domain users to log on using biometrics

Each time I have enabled these, I have done both a gpupdate /force and also a full reboot of the computer. I have never been able to get past the stage where the "Windows Hello Setup" grey dialog box comes up and then goes away after 7-8 seconds without
displaying anything further.

Thank you.

 

biometric devices

Hi,

Thank you for posting your query on Microsoft Community.

I understand your inconvenience. We will assist you to resolve this issue.

I suggest you to follow the methods provided below and check if it helps.

Method 1: Enable Biometric option.

I suggest you to enable the Biometrics to pick up the Biometrics setting. This option shall be enable by default. However, I recommend you to follow the steps provided below and check if it enable or not.

• Press Windows logo key + R key.
• Type gpedit.msc and press
  Enter key.
• Under Computer Configuration, navigate to.

Administrative Templates Windows Components Biometrics

In the left hand panel of the Windows, double click on the following:

• Allow the use of biometrics
• Allow users to log on using biometrics

Select enable option and click on Apply and
OK button.

Now, restart your computer and follow the instructions provided below.

After restarting the computer, I suggest you to disconnect and reconnect the fingerprint sensor device and check if the drivers are getting detected in Device Manager. If the issue still persist, follow method 2.

Method 2: Reinstall drivers and compatibility mode.

I suggest you to download and install the latest drives for fingerprint sensor device from the manufacture’s website and check if it gets detected.

If the issue still persist, you may also install the drivers in compatibility mode and check.

Follow the steps to install the drivers in compatibility mode.

• Download the drivers from the manufacturer’s website.
• Right-click on the installer and click on "Properties".
• Click on the ‘compatibility’ tab and check the box "Run this program in compatibility mode for” and select previous Operating System from the drop down.
• Click on ‘Apply’ and click ‘OK’ and run the file to install it.

After installing the drivers in compatibility mode, follow the method 3 and check if you are able to get the sign in option with Biometric.

Method 3:

• Press Windows logo key + I key.
• Click on Accounts.
• Go to Sign in options.
• The fingerprint option will always be visible if there is a WBF-supported fingerprint reader (and its associated driver) installed on the computer.

For more information, refer the following Microsoft help article.

Biometric Devices

Biometric Devices (Windows Drivers)

Hope it helps. Do let us know if your issue is resolved. For any further query, feel free to contact us.

Thank you.