Windows 10: Windows Hello for Business

Even with Windows Hello enforced via policy in Microsoft Intune, users can still sign in via single authentication using their password. I am currently testing if Windows Hello for Business is a viable MFA or Passwordless solution. Is there a way to make users use their Yubioco security key and not have the option to sign in via password authentication?

:)

 

Windows 10 Hello for Business with Physical Smartcard and roaming uses across shared PC's

Hi Rosenbrier,



Thank you for writing to Microsoft Community Forums.



With the recent ratification of security keys by FIDO, Windows Hello allows security authentication for shared devices that allows full roaming experience. For more information, I would suggest you to refer to the article
Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared
devices and see if it helps.



If you have any further query regarding the same, I would suggest you to post your query in the
IT Pro TechNet Forums, where we have support professionals well equipped with the
knowledge on Windows Hello for Business.



Additional Info:

• Implementing strong user authentication with Windows Hello for Business
  
• Windows Hello for Business Frequently Asked Questions
  
  

Regards,

 

Can't disable Windows Hello for Business

I receive this error in Event Viewer whenever I boot Windows 10 Pro version 1709 build 16299.309.

Windows Hello for Business provisioning will not be launched.

Device is AAD joined ( AADJ or DJ++ ): Not Tested

User has logged on with AAD credentials: No

Windows Hello for Business policy is enabled: Not Tested

Local computer meets Windows hello for business hardware requirements: Not Tested

User is not connected to the machine via Remote Desktop: Yes

User certificate for on premise auth policy is enabled: Not Tested

Machine is governed by none policy.

See What's new in Active Directory Federation Services for Windows Server 2016 | Microsoft Docs for more details.

I tried the following suggestion:

"Type gpedit.msc Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Passport for Work OR Windows Hello for Business Edit "Use Microsoft Passport for Work" OR "Use Windows Hello for Business" and set it to disabled."

I checked the registry and \HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork Enabled is set to 0.

I am using the Administrator account.

The error continues at every bootup.

Thank you.

 

Can't disable Windows Hello for Business

Hi Ted,


Just to share the difference between Windows Hello and Windows Hello for business.



Windows Hello just use fingerprint or face recognition uniquely identifies and authenticates that user to access Windows on that device.

Windows Hello for Business is Microsoft Passport technology. It uses "Windows Hello" to release a stored credential that is used as the second authentication factor by Microsoft Passport.

And Windows Hello for Business can only be used in AD or Azure AD. If you are deploying the policy to enable Windows Hello for Business, you can remove the GP, don't link them to OU, so that the client will not be applied the
policy. Then remove the Windows Hello in Sign-in options.



Since your concern needs an in-depth technical expertise, we suggest that you post your query to our

Microsoft TechNet forum page, where the community members are more versed with the matter. There are IT specialist and professional who can provide the best solution for your concern.



Regards,