Windows 10: Windows Hello for business is not prompting for registration when user signs in

I am experiencing issues while attempting to enable Windows Hello for Business. Despite following the setup instructions, the feature does not appear to work as expected. I'm expecting a prompt to register for hello for business when user signs into a computer but it's not happening. I've configured the cloud trust model which is working according to how Microsoft recommends testing for it. Details are below does anyone have any recommendations to try?I've verified the GPO is applied to the workstation with the following settings:Use Cloud trust for on-premises authenticationUse windows Hello

:)

 

Windows Hello For Business Cloud Trust

I am running into 2 issues that would love some clarity on:

- 1 computer I am unable to setup a pin on.

Keep getting the error during step up auth after entering my credentials to receive the 2fa prompt it fails with "Unable to get a token using the Web Account Manager. Error Unknown HResult Error Code 0x801c044f

Has anyone run into this before, registration on laptop appears to work with no issue.

- How does Windows Hello for Business registration work for secondary users of a laptop?

I was able to successfully register my primary user but the secondary user never get's prompted after login by the registration wizard. If I go into sign in options it says it isn't available until I am on the organization network but I am and have line of sight to my domain controller.

 

Enforce Windows Hello for Business for selective users

Hi,



We have configured Windows Hello for Business in a Hybrid Azure AD joined environment and this works absolutely fine. Now we have the following requirement -



- At the Windows Login prompt - We need to enforce users to use Windows Hello For Business (if they try to use userid and password, it should not be allowed with a polite warning ). This is easily achieved using the Security Options policy - Interactive Logon - Require Windows Hello for Business. However the challenge is that this is a computer configuration policy hence can't be enforced for particular users. So once a user is signed in - and if a support personnel wants to run a privileged program aka Run-as or Run as Administrator. Then the pop-up does not accept the userid and password instead enforces Windows Hello for Business which is impractical as the support personnel is most cases is remote.



So the question is - how to we enforce Windows Hello for Business for a selective set of users only and not for local administrators or a predefined domain security group.



Thanks

Ravi

 

Windows Hello for Business

Even with Windows Hello enforced via policy in Microsoft Intune, users can still sign in via single authentication using their password. I am currently testing if Windows Hello for Business is a viable MFA or Passwordless solution. Is there a way to make users use their Yubioco security key and not have the option to sign in via password authentication?