Windows 10: Windows Hello For Business default PIN logon

Good morning,I have read the following article and every other article I could find regarding this hurdle. I have made registry DWORD changes and I have created new DWORD values and nothing I have done has yielded any noticeable changes. My question is very simple, but it's starting to look like it is not possible or I'm doing something wrong which is ALWAYS possible https://answers.microsoft.com/en-us/windows/forum/all/how-do-i-make-my-pin-as-a-default-login/2c5034cd-2ca2-4671-9d5f-41a9b8a252a0Scenario:Azure AD Hybrid joined devicesWindows Hello For Business - enabled from Endpoint no

:)

 

Login with PIN and Hello

Hi Jean,

Windows 10 includes multiple options to sign-in to your account, including the ability to sign-in using a PIN and Windows Hello, which uses facial recognition. For us to provide a solution suited to your concern, we need additional information. Can
you answer the questions below?

• How are you setting the PIN and Hello?
• Which build version of Windows is your PC running on?
• Were there any error codes or messages?

In the meantime, we suggest that you follow the steps below on how to set up PIN.

• Open Settings.
• Select Accounts.
• Click Sign-in options.
• Click the Add button for the PIN and set your PIN.
• Do the same for the Windows Hello.

Looking forward to your response.

 

Can't enable Windows Hello - Some settings are managed by your organization

I found the solution. The reason is that Windows Hello is managed differently on domain joined computers, starting with the anniversary update.
To get it to work you have to follow these steps:

1) Setup a Group Policy Central Store (you should already have that)

2) Get Windows 10 Anniversary Update Group Policy Templates. You can do so by copying your files from PolicyDefinitions (in windir on a Win10 Anniversary Update machine) into the PolicyDefinitions of the central store. You might copy those files first to a file share, because of permissions your regular user should not have on the central store.

3) Setup a new GPO or add to an existing the following settings to enable Windows Hello:

• Computer Configuration/Policies/Administrative Templates
  

.../Windows Components/Windows Hello For Business/ Use biometrics => Enabled

.../Windows Components/Windows Hello for Business/ Use a hardware security device => Enabled (if you want to use TPM instead of key or certificate based activation for Windows Hello). Note that in general all business computers should have TPM

.../System/Logon/ Turn on convenience PIN sign-in => Enabled (This is the key. This enables PIN sign-in which in turn will enable Hello, together with the other settings.)

.../Windows Components/Biometrics/ Allow domain users to log on using biometrics => Enabled (I think this is enabled by default, but being explicit makes GP management a lot easier.)

You will find more optional configuration possibilities in System/Logon and Windows Components/Biometrics and Windows Components/Windows Hello for Business.

You will find more background here:
Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

and here

https://technet.microsoft.com/en-us...ement-microsoft-passport-in-your-organization

Most important excerpt:

If you want to use key or certificate based Windows Hello you can follow the guides in the links. Don't get confused though. You can still use regular TPM for normal Windows Hello.