none
Use fingerprint logon without Windows Hello configuration - possible? RRS feed

  • Question

  • I am preparing out organization to deploy windows 10 1607 enterprise edition. I am trying to configure it to allow fingerprint logon into Windows 10. Looks like it is not possible without setting PIN, am I right? We are talking about domain joined (on premise, no Azure or Intune). I already read this https://docs.microsoft.com/pl-pl/azure/active-directory/active-directory-azureadjoin-passport-deployment

    and tried to use GPO settings described there but still setting PIN options are disabled. Anything more should be done?

    Friday, December 9, 2016 9:00 AM

All replies

  • In order to setup and use fingerprint reader you must setup a PIN to log in to Windows 10.

    S.Sengupta, Windows Insider MVP

    Saturday, December 10, 2016 11:55 PM
  • Hi bbelko,

    At the launch of Windows 10, the operating system supported three Hello types: PIN, Facial recognition and Fingerprint recognition.

    Before you can use Windows Hello to enable biometrics on a device, you must choose a PIN as your initial Hello gesture. After you’ve set a PIN, you can add biometric gestures if you want to. You can always use the PIN gesture to release your credentials, so you can still unlock and use your device even if you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly.

    So the answer here is no, there is no way to disable the PIN, instead, we could change it, at least for the current situation.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, December 12, 2016 7:44 AM
    Moderator
  • Ok, as I wrote, I set up GPO Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Hello for Business. but the option for setup PIN is still grayed out. What more should be done?
    Monday, December 12, 2016 7:52 AM
  • Ok, as I wrote, I set up GPO Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Hello for Business. but the option for setup PIN is still grayed out. What more should be done?

    That's because starting in Windows 10, Version 1607, the default behavior to allow convenience PIN creation has changed. The new default is that convenience PINs cannot be created on domain joined machines unless you specifically enable it via policy:

    More information, read this blog:

    Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

    https://blogs.technet.microsoft.com/ash/2016/08/13/changes-to-convenience-pin-and-thus-windows-hello-behaviour-in-windows-10-version-1607/


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, December 12, 2016 8:03 AM
    Moderator
  • Ok, so what is the proper\secure solution for enterprise to allow users to use fingerprint to login into Windows 10 1607 ? Not convenience PIN as I understand. So what's more should be enabled to configure Windows Hello for Business (except GPO which I mentioned) ?
    Monday, December 12, 2016 8:25 AM
  • Ok, so what is the proper\secure solution for enterprise to allow users to use fingerprint to login into Windows 10 1607 ? Not convenience PIN as I understand. So what's more should be enabled to configure Windows Hello for Business (except GPO which I mentioned) ?

    As my previous post, You need add a PIN before you can set up Windows Hello. After that, you will get the 3 sign in options, password, PIN, Fingerprint.

    Please read this blog in details:

    Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

    https://blogs.technet.microsoft.com/ash/2016/08/13/changes-to-convenience-pin-and-thus-windows-hello-behaviour-in-windows-10-version-1607/


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, December 20, 2016 2:07 AM
    Moderator
  • Yes, but the original question asked was:

    "Use fingerprint logon without Windows Hello configuration - possible?"

    Basically, I have a laptop that "Windows Hello" will not install on (Although the PIN option works) so want to find out if there is a way to make the fingerprint login work without having "Windows Hello" installed.

    Thanks,  Scott

    Sunday, November 19, 2017 5:18 PM