Windows Hello Unavailable

Topic

New Reply

Windows Hello is disabled for users and says ‘This option is currently unavailable’ for Facial recognition, Fingerprint and PIN. There is a message above stating that ‘Some of these settings are managed by your organization’

Machines are connected to Intune and Windows Hello for Business is enabled there at the tenant level.  We are a Hybrid AD so machines do get GPOs but there is no WHfB GPO enabled.

We’ve done all the research on prerequisites and still don’t seem to have any luck enabling it. We’ve also tried Intune Configuration Policies to specifically push to users rather than depending on the tenant-level. Nothing works. Some users have had luck if we modify the registry key but not all, and that’s not an option to do for everyone.

Where else can I check to see what’s keeping it disabled?

Reply | Quote

Replies

In Windows Update, clicking on ‘Some of these settings are managed by your organization’ gives some clue to which Group Policy settings are responsible. Does that work under Windows Hello?

Reply | Quote

From my angle of perpective, Windows Hello and PIN are sytematically disabled in large organisations(enterprises), just because they do not meet security regulations. Usually its not possible to enforce policy like 3-months validity, complexity or history. This said – I have it seen disabled in all three global organisations I work for as a contractor.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

Windows Hello PIN expiry, complexity and history can be configured by group policy:

Group Policy settings for Windows Hello for Business — PIN complexity

Which regulations don’t they meet?

1 user thanked author for this post.

doriel

Reply | Quote

Very nice link, b.

Maybe some of these settings are disabled for @RRtechgroup

Windows Hello as a convenience PIN is disabled by default on all domain joined and Microsoft Entra joined devices.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

I suggest to run

whoami /groups

you can check the security goup membership for affected users. I mean – look for groups that are different for users who is able to set it and is not able to set it.

I dont know how it works with Azure/Intune, but on the good old AD, I would open group policy editor and look what is blocking it.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote