Windows Hello For Business (WHfB)
On business Windows PCs, you can set up Windows Hello For Business (Windows login via PIN, fingerprint or facial recognition) as authentication in the standard configuration.
Prerequisites:
- Your PC is equipped with the necessary hardware and has an activated TPM 1.2 or 2.0 module.
- You must have set up multi-factor authentication (MFA) before setting up WHfB, as Windows Hello For Business requires identity confirmation via MFA. The Microsoft Authenticator app is recommended as MFA.
Central Windows settings were changed on April 9th. Therefore, users who have already used a Windows Hello PIN (Convenience Pin) or a Windows Hello fingerprint for authentication before April 9, 2024 must first delete them and set them up again. The new setup requires confirmation via MFA.
Tips & tricks, known issues and troubleshooting:
- Check whether Windows Hello for Business has been enabled: The Enabled value should be set to 1 in the registry below HKLM\SOFTWARE\Policies\Microsoft\PassportForWork.
- Delete pin is grayed out. In this case, the link Forget pin can be selected. Then press Next and cancel the setup of the new pin. The Hello pin should then be deleted.
- Delete pin via command line: To do this, open the CMD by right-clicking Run as administrator and enter the following command:certutil.exe -DeleteHelloContainer
Then log out.
