Windows Hello for Business

The wizard will only appear once the policy has been activated on your device. it might take some time (up to 8 hours). If you have been using your device for a few days after June 19 and still do not see the wizard after restarting: it could mean that the computer is not compatible, not LISA managed, a special device or Windows may not be compatible yet. Please contact the service desk to verify this.

Your PIN, smile, or fingerprint only opens the secure vault on your computer where half of the key is stored, which never leaves the device. The other half of the key is securely stored online by Microsoft in your account. Together, these two keys provide access to your device, websites, and files. Even if someone manages to obtain your PIN through phishing, it can only be used on your device and not, unlike a regular password, from another location. Additionally, if you use your face or fingerprint, the chance of someone being able to observe your PIN is eliminated.

More technical explanation 
Windows Hello for Business provides a significantly more secure method for logging in than traditional passwords, even those with 14 characters. Traditional passwords are vulnerable to cyberattacks, including phishing, brute force attacks, and credential stuffing. In contrast, Windows Hello for Business enhances security by using biometric authentication and Microsoft Cloud Trust to verify a user’s identity. An asymmetrical key pair is created: one key is stored on the device, and the other is held by the identity provider. Access is granted only when these keys are combined. Therefore, these keys are used to access the device, not the PIN itself. A 6-digit PIN can be more secure than a 14-character password because the PIN is tied to the specific device and cannot be used elsewhere. Additionally, the PIN is just one part of a multi-factor authentication process that includes the device and biometrics, significantly reducing the attack surface compared to traditional passwords. The asymmetrical key pair adds another layer of security, ensuring that the PIN alone is insufficient without the corresponding device and biometric verification.

Navigate to Settings > Accounts > Sign-in options > PIN (Windows Hello) > I forgot my PIN, or when you know your PIN but you want to change the PIN, choose Change PIN.

Yes, in the sign-in screen, you can also choose to sign in with your password in the sign-in options. The video shows the different sign-in options. Click on the key icon if you want to sign in with your password.

Contact our servicedesk. They will ensure that the policy is disabled on the device and that a Windows Hello Removal Tool application becomes available in the Company Portal, which can be used to completely disable Windows Hello on the device.

Windows Hello for Business will not be activated on specials known to LISA, such as lab PCs, measurement systems and lecture room PCs. If there is a situation where Windows Hello for Business needs to be activated on such a PC, please contact the Service desk for assistance.

You can purchase a compatible device from the Self Service Portal or setup a 6-digit pin code. For this, see the products marked with: Windows Hello. Discuss this first with your budget responsible.

Easily adjust them in Settings > Accounts > Sign-in options.

See the video in the section above.

Yes, it offers enhanced security with phish-resistant two-factor authentication and built-in brute force protection. Learn more on the Microsoft website.

No, biometric data like fingerprints or facial recognition remains on your device and isn't transmitted or shared with Microsoft or other parties.

You'll go through a wizard to set up a PIN code instead. If you'd like to use biometric login features, you can purchase a supported webcam or fingerprint scanner from the Self Service Portal.

You can complete the wizard at home, but biometric logins might not be possible the first time until you connect to the VPN. (This generally applies only to AD-managed computers.) If you are off-campus after provisioning and receive a message  that login is not possible when attempting to log in for the first time using PIN, FACE, or Fingerprint, resolve this by:

• Select in logon screen sign-in options;
• Choose password (Key icon);
• Logging in with your username and password;
• Start EduVPN;
• Lock your computer (Windows key + L);
• Unlock your computer and choose a preferred sign-in option PIN, FACE, or Fingerprint;
• Windows Hello for Business is now fully configured.

This only applies to the first login; subsequent logins with PIN, FACE, or Fingerprint will be possible without a VPN connection, just like with your traditional password.

If the wizard doesn't allow you to set up the fingerprint, it's likely that the hardware isn't compatible. Often, what may appear to be a scanner is just a cover or a similar feature without the actual fingerprint scanning capability.

The maximum number of supported enrollments on a single device is 10. Which means 10 users may setup face recognition and/or there fingerprint to access the device. For devices with more than 10 users it's recommended the use of FIDO2 security keys.

Windows Hello for Business is not designed to work with local accounts.

You can use an external Windows Hello compatible camera if a device has an internal Windows Hello camera. When both cameras are present, the external camera is used for face authentication.