Windows 10: Enable or Disable Sign in to Windows 10 using Companion Device

Brink · Nov 9, 2016

How to: Enable or Disable Sign in to Windows 10 using Companion Device

How to Enable or Disable Users to use Companion Device to Sign in to Windows 10

Users can use a sign in to a desktop computer running Windows 10. The companion device provides a second factor of authentication with Windows Hello.

There are numerous ways one can use the Windows Hello companion device framework to build a great Windows unlock experience with a companion device. For example, users could:

Attach their companion device to PC via USB, touch the button on the companion device, and automatically unlock their PC.

Carry a phone in their pocket that is already paired with PC over Bluetooth. Upon hitting the spacebar on their PC, their phone receives a notification. Approve it and the PC simply unlocks.

Tap their companion device to an NFC reader to quickly unlock their PC.

Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks.

This tutorial will show you how to enable or disable the ability to sign in using a Windows Hello companion device for all users in Windows 10.

*Warning You must be signed in as an administrator to enable or disable the ability to sign in using a Windows Hello companion device.

CONTENTS:

Option One: Enable or Disable Users to use Companion Device to Sign in to Windows 10 using Local Group Policy Editor

Option Two: Enable or Disable Users to use Companion Device to Sign in to Windows 10 using a REG file

OPTION ONE [/i] Enable or Disable Users to use Companion Device to Sign in to Windows 10 using Local Group Policy Editor

*note The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Two below.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\Windows Components\Microsoft Secondary Authentication Factor

3. In the right pane of Microsoft Secondary Authentication Factor in Local Group Policy Editor, double click/tap on the Allow companion device for secondary authentication policy to edit it. (see screenshot above)

4. Do step 5 (enable) or step 6 (disable) below for what you would like to do.

5. To Enable Users to use Companion Device to Sign in to Windows 10
A) Select (dot) Not Configured or Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

*note Not Configured is the default setting.

6. To Disable Users to use Companion Device to Sign in to Windows 10
A) Select (dot) Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

7. When finished, you can close the Local Group Policy Editor.

OPTION TWO [/i] Enable or Disable Users to use Companion Device to Sign in to Windows 10 using a REG file

*note The downloadable .reg files below will add and modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SecondaryAuthenticationFactor

AllowSecondaryAuthenticationDevice DWORD

(delete) = Enable
0 = Disable

1. Do step 2 (enable) or step 3 (disable) below for what you would like to do.

2. To Enable Users to use Companion Device to Sign in to Windows 10
*note This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Enable_sign_in_with_companion_device.reg

Download

3. To Disable Users to use Companion Device to Sign in to Windows 10
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Disable_sign_in_with_companion_device.reg

Download
4. Save the .reg file to your desktop.

5. Double click/tap on the downloaded .reg file to merge it.

6. When prompted, click/tap on Run, OK (UAC), Yes, and OK to approve the merge.

That's it,
Shawn

Related Tutorials

How to Sign in to Windows 10

How to Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics

How to Enable or Disable Users to Sign in to Windows 10 using Biometrics

:)

Vidyashree_C · Oct 27, 2019

Re-enable audio device

Hi,

I would be happy to assist you.

Before we proceed with troubleshooting, I would need little information on the issue.

Are using speakers / head phones to listen to audio?

If you have disabled the audio device, then you might not see it under the list of playback devices. I would suggest you to follow these steps to make sure you see the disabled devices:

Open
Control panel.

Click Hardware and Sound and then Click on
Sounds.

Under Playback tab, right click on the empty area and make sure
“Show Disabled Devices” has a check mark on it. If headphones/Speakers are disabled, it will now show up in the list.

Right click on the device and
Enable it. Click OK.

If the issue still persists, try enabling speakers automatically using steps below.

Go to Settings> Click on themes> Advance sound settings> right click on the speakers or the audio device youo have connected > click on
Configure device.

Test the sound level you want, click Next.

And configure the audio devices.

Hope this helps you. Do reply if you need further assistance on Windows 10.

Thank you.

Brink · Oct 27, 2019

Credential Guard lab companion

If you have heard about Credential Guard in Windows Server 2016 (and in Windows 10), but do not have an environment to try it out, here is a lab environment we built for you to play.

Lab access

The link will lead you to a sign up page, after that, you will see the following labs listed for Windows Server 2016:

Windows Server 2016 labs

There are 3 exercises in the “Implementing Breach Resistance Security in Windows Server 2016”:

Credential Guard

Remote Credential Guard

Device Guard

This blogpost will walk you through the Credential Guard lab details.

After click on the link of Breach Resistance lab, you be required to sign in and then you can launch the lab:

Sign-in

Launch page

It takes a few minutes to create the VMs, and once it has done, you will see the following machines prepared:

Initialize

DC: domain controller, which is not used for this exercise.

SRV01 and SRV02: both are Windows Server 2016, and used for the lab exercise.

Lab exercise – Explained

The steps are listed in the Content section:

Content

This lab is structured to cover the following in sequence:

Understand how attackers can use the hash in memory to gain access to domain controllers

Configure Credential Guard

Verify the hash in memory is protected using Credential Guard

You can follow the steps listed under the content section to complete the lab, the intent of the blog, is to break the procedures into groups, to help you understand the exercise better.

Prep the hash

Lsass.exe is the process which handles user logon, it stores the user credential information in its memory. The memory is cleared when the machine starts up. In this lab environment, all the virtual machines start at the time lab launches, when you logon to the machine, you will only have the logon user credential information in memory. In order to demonstrate an attacker gaining user access using other account’s hash, the first part of the lab is to simulate a server which has been running for a while, different users had remotely or locally connected to it, therefore, lsass memory stored many different user credential information.
This is accomplished by step 1-8.

Retrieving credential hash

Mimikatz is a popular tool for retrieving lsass memory information. The tool has been copied to the lab machines, step 9-13 walk you through the process of dumping lsass memory using Mimikatz.

Pass the Hash

Pass the hash is a hacking technique that allows an attacker to authenticate by using the underlying NTLM, instead of specifying the user password. In step 14 to 24, you will extract LabAdmin hash from lsass using Mimikatz, and use the hash to open a PowerShell console, and perform a couple of operations using the LabAdmin privilege:

Add a user to the domain admin group

Open remote PowerShell connection to a domain controller

Both operations could not be performed by the logon user. But using the hash of the LabAdmin, an attacker will be able to do it using the information retrieve from Lsass memory.

Configure and verify Credential Guard

Step 25 to 36 illustrate the steps to configure credential guard, then verify its status using msinfo32.exe and PowerShell.

Step 37 to 43 goes further to use Mimikatz to show the hash in Lsass is now encrypted using Credential Guard.

More info

The exercise illustrated the benefit of Credential Guard in Windows Server 2016 as well as Windows 10. For more information, you can find here.
Click to expand...

Source: Credential Guard lab companion Datacenter and Private Cloud Security Blog

See also:

Enable or Disable Credential Guard in Windows 10 Windows 10 Security System Tutorials

Verify if Credential Guard is Enabled or Disabled in Windows 10 Windows 10 Security System Tutorials

chispy · Oct 27, 2019

Creative X-Fi Soundcards and Windows 10 Fall Creators Update 1709 = Complete Disaster / Not Working

Any Windows update breaks my Creative sound drivers. Best way for me is to disable it via group policy:

Go to Run –> gpedit.msc

In the Group Policy Editor, go to Computer Configuration –> Administrative Templates –> System –> Device Installation –> Device Installation Restrictions

In the right hand pane, select “Prevent installation of devices not described by other policy settings” and set it to Enabled.

Once that's done, uninstall the driver Windows put in there and install the correct one.
Click to expand...

Thank you for trying to help , i did tried your suggestion but it did not work :/ , nothing seems to make it work on Windows 10 Fall Creators Update 1709. In the meantime i have bought a new SoundBlasterX AE-5 and it did installed flawlessly , no problems whatsoever. it is up to Creative ( drivers ) and Microsoft ( bug fix ) to fix this huge bugs with Audio.

Kind Regards: Chispy

erocker · Oct 27, 2019

Creative X-Fi Soundcards and Windows 10 Fall Creators Update 1709 = Complete Disaster / Not Working

Any Windows update breaks my Creative sound drivers. Best way for me is to disable it via group policy:

Go to Run –> gpedit.msc

In the Group Policy Editor, go to Computer Configuration –> Administrative Templates –> System –> Device Installation –> Device Installation Restrictions

In the right hand pane, select “Prevent installation of devices not described by other policy settings” and set it to Enabled.

Once that's done, uninstall the driver Windows put in there and install the correct one.

Brink · Oct 27, 2019

Windows Hello supports a growing variety of secured companion devices

Nearly 100 unique biometric-enabled Windows devices and accessories are available across form factors, with growing opportunity for partners. Today, we’re highlighting a few of the latest Windows Hello companion devices that have been built by our partners.

This past year was an exciting one: we saw even more great Windows 10 devices introduced to our customers that take advantage of the password-free security benefits of Windows Hello. Built in to Windows 10, Windows Hello takes away the hassle of remembering passwords and minimizes security risks for millions of Windows customers. With Windows Hello, you can simply and uniquely use your face, fingerprints, or a PIN to quickly and more securely sign-in to your Windows 10 device.

Over the last year, one of our top priorities was to make this technology available on the widest variety of devices. Today, Windows Hello can be used on nearly every Windows 10 device in the world natively with a PIN or integrated biometric sensor or with an accessory. In fact, during the 2016 holiday season we counted nearly 100 unique biometric-enabled Windows devices and accessories available across all form factors, including laptops, all-in-ones, 2-in-1s, tablets, phones and peripherals.

While using Windows Hello with devices that include embedded biometric sensors is a great way for consumers and enterprises to get password-free security, companion experiences can also provide greater security and convenience enabled with Windows Hello. Since first announcing the companion device framework at Build 2016, we have had more than 20 partners join our efforts to make passwords a thing of the past. By opening the Windows Hello companion device framework to the hardware industry, our partners are delivering differentiated and innovative Windows Hello devices that meet the needs of both consumers and businesses, including those in heavily regulated industries.

Some of the Windows Hello companion device partners.

Here’s a glimpse into a handful of companion devices for both consumer and business scenarios.

Nymi Band

YEj3UklcFe0

The is a wearable Windows Hello companion device that allows you to sign into your Windows 10 device without a password. Just walk up to your PC wearing the Nymi Band, tap the band to express your intent, and then you’ll be quickly signed into your device. The band does this after Nymi’s HeartID™ technology confirms it’s actually you using your heartbeat and their unique electrocardiogram (ECG) based authentication technology. You can read more about the Nymi Band solution here.

The Nymi Band is a wearable Windows Hello companion device.

YubiKey

8TokpxO6J7Q

The from Yubico is a USB connected Windows Hello companion hardware device. By plugging the device into a USB port, the device allows you to quickly and more securely unlock your Windows device. The YubiKey is an inexpensive, practically indestructible device and can support additional two-factor authentication, including NFC, making the YubiKey a great solution for today and the future. You can read more about the Yubikey solution here.

Yubikey works with Windows Hello to unlock your device with USB hardware.

RSA SecureID Access Authenticator

MeR3BVu3HQA

The turns existing devices that almost everyone owns into a Windows Hello companion device. The RSA SecurID Access Authenticator app runs on your mobile device and it can remotely sign you into your Windows 10 PC based on your proximity to the device or through the entry of a PIN or biometric verification from the app, depending on certain risk factors. You can read more about the RSA solution here.

The RSA SecureID Access Authenticator lets you verify your identity by shaking or tapping the device.

HID Global Seos card

eaAgX4IYApw

You might be familiar with HID Global whose cards are used by organizations around the world for IT authentication, building access, time and attendance, and cashless payments. is an NFC-based companion device that enables you to tap to unlock Windows Hello. By using your employee badge as your Windows companion device, you get the added convenience of using something that you already have with you. A high assurance version of the HID Global card also supports digital signing and encryption based on NIST standards. You can read more about the HID Seos solution here.

Windows Hello is changing the way we interact and authenticate our devices, apps, and web services. Together with our partners, companion devices using Windows Hello will further empower our customers to have more secure, password-free experiences. Our growing partner community building innovative companion devices understands that Windows Hello conforms to industry and government standards like FIDO, now endorsed by governments, making Windows Hello and companion devices a safer bet for customers and the partner community alike.

Partners who are interested in discussing the opportunities for Windows Hello companion devices can get in touch with our team at: L: cdfonboard@microsoft.com.

*Windows Hello requires specialized hardware, including fingerprint reader, illuminated IR sensor or other biometric sensors and capable devices.
Click to expand...

Source: https://blogs.windows.com/windowsexp...panion-devices

Windows 10: Enable or Disable Sign in to Windows 10 using Companion Device

Enable or Disable Sign in to Windows 10 using Companion Device

Enable or Disable Sign in to Windows 10 using Companion Device

Enable or Disable Sign in to Windows 10 using Companion Device

Enable or Disable Sign in to Windows 10 using Companion Device - Similar Threads - Enable Disable Sign

Enable/Disable Audio devices

Using IPhone as a companion device for Windows Hello

Disable or Enable Domain Users Sign in using Biometrics on Windows 10

how to disable / enable devices using command line in Windows 10

Enable or Disable Users to Sign in to Windows 10 using Biometrics

Enable or Disable Domain Users Sign in to Windows 10 using Biometrics

Enable or Disable PIN Reset at Sign-in in Windows 10

Enable or Disable Device Guard in Windows 10

Enable or Disable Console Mode Sign-in in Windows 10

Users found this page by searching for:

use companion device to sign in