Use fingerprint logon without Windows Hello configuration - possible?

Article
2016-12-09

Question

_{Friday, December 9, 2016 9:00 AM}

I am preparing out organization to deploy windows 10 1607 enterprise edition. I am trying to configure it to allow fingerprint logon into Windows 10. Looks like it is not possible without setting PIN, am I right? We are talking about domain joined (on premise, no Azure or Intune). I already read this https://docs.microsoft.com/pl-pl/azure/active-directory/active-directory-azureadjoin-passport-deployment

and tried to use GPO settings described there but still setting PIN options are disabled. Anything more should be done?

All replies (7)

_{Saturday, December 10, 2016 11:55 PM}

In order to setup and use fingerprint reader you must setup a PIN to log in to Windows 10.

S.Sengupta, Windows Insider MVP

_{Monday, December 12, 2016 7:44 AM}

Hi bbelko,

At the launch of Windows 10, the operating system supported three Hello types: PIN, Facial recognition and Fingerprint recognition.

Before you can use Windows Hello to enable biometrics on a device, you must choose a PIN as your initial Hello gesture. After you’ve set a PIN, you can add biometric gestures if you want to. You can always use the PIN gesture to release your credentials, so you can still unlock and use your device even if you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly.

So the answer here is no, there is no way to disable the PIN, instead, we could change it, at least for the current situation.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, December 12, 2016 7:52 AM}

Ok, as I wrote, I set up GPO Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Hello for Business. but the option for setup PIN is still grayed out. What more should be done?

_{Monday, December 12, 2016 8:03 AM}

Ok, as I wrote, I set up GPO Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Hello for Business. but the option for setup PIN is still grayed out. What more should be done?

That's because starting in Windows 10, Version 1607, the default behavior to allow convenience PIN creation has changed. The new default is that convenience PINs cannot be created on domain joined machines unless you specifically enable it via policy:

More information, read this blog:

Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

https://blogs.technet.microsoft.com/ash/2016/08/13/changes-to-convenience-pin-and-thus-windows-hello-behaviour-in-windows-10-version-1607/

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, December 12, 2016 8:25 AM}

Ok, so what is the proper\secure solution for enterprise to allow users to use fingerprint to login into Windows 10 1607 ? Not convenience PIN as I understand. So what's more should be enabled to configure Windows Hello for Business (except GPO which I mentioned) ?

_{Tuesday, December 20, 2016 2:07 AM}

Ok, so what is the proper\secure solution for enterprise to allow users to use fingerprint to login into Windows 10 1607 ? Not convenience PIN as I understand. So what's more should be enabled to configure Windows Hello for Business (except GPO which I mentioned) ?

As my previous post, You need add a PIN before you can set up Windows Hello. After that, you will get the 3 sign in options, password, PIN, Fingerprint.

Please read this blog in details:

Changes to Convenience PIN / Windows Hello Behavior in Windows 10 Version 1607

https://blogs.technet.microsoft.com/ash/2016/08/13/changes-to-convenience-pin-and-thus-windows-hello-behaviour-in-windows-10-version-1607/

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].