How to Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics


Windows Hello biometrics lets you sign in to your devices, apps, online services, and networks using your face, iris, or fingerprint.

For more information about Windows Hello, see:

By default, users with a domain account can sign in to Windows 10 and elevate UAC permissions using biometrics unless disabled via policy.

This tutorial will show you how to enable or disable allowing domain users to sign in to Windows 10 using biometrics.

This policy will not effect local users to sign in using biometrics.

You must be signed in as an administrator to enable or disable allowing domain users to sign in using biometrics.


 CONTENTS:

  • Option One: Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics in Local Group Policy Editor
  • Option Two: Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics using a REG file





OPTION ONE

Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics in Local Group Policy Editor



The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Two below.

1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

Computer Configuration\Administrative Templates\Windows Components\Biometrics

Enable or Disable Domain Users Sign in to Windows 10 using Biometrics-domain_user_biometrics_sign_in_gpedit-1.png

3. In the right pane of Biometrics in Local Group Policy Editor, double click/tap on the Allow domain users to log on using biometrics policy to edit it. (see screenshot above)

4. Do step 5 (enable) or step 6 (disable) below for what you would like to do.


 5. To Enable Domain Users to Sign in to Windows 10 using Biometrics

A) Select (dot) Not Configured or Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

Not Configured is the default setting.


 6. To Disable Domain Users to Sign in to Windows 10 using Biometrics

A) Select (dot) Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

Enable or Disable Domain Users Sign in to Windows 10 using Biometrics-domain_user_biometrics_sign_in_gpedit-2.png

7. When finished, you can close the Local Group Policy Editor.






OPTION TWO

Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics using a REG file



The downloadable .reg files below will add and modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider

Domain Accounts DWORD

0 = Disable
1 = Enable


1. Do step 2 (enable) or step 3 (disable) below for what you would like to do.


 2. To Enable Domain Users to Sign in to Windows 10 using Biometrics

This is the default setting.

A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Enable_domain_users_to_sign_in_using_biometrics.reg

Download


 3. To Disable Domain Users to Sign in to Windows 10 using Biometrics

A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Disable_domain_users_to_sign_in_using_biometrics.reg

Download

4. Save the .reg file to your desktop.

5. Double click/tap on the downloaded .reg file to merge it.

6. When prompted, click/tap on Run, OK (UAC), Yes, and OK to approve the merge.


That's it,
Shawn


Related Tutorials



  • Windows 11 Tutorials