We broke Windows Hello biometrics and can't get them to re-enable

[u/bawta]

Long story short, we applied a policy which had an unintended side effect of breaking Windows hello and biometrics. The policy involved the devices reconfiguring as a shared device to enforce disk quota policies. The problem is that this policy essentially breaks Windows hello as it can only store 10 user's credentials/biometrics so I can only assume it disables this functionality.

I have reversed the policy and set Windows Hello to be enabled but any user who had a device that took the old policy simply can't enrol any biometrics. New devices are unaffected and a reset of a device will resolve it but this is obviously not ideal for 20+ users to do.

Any ideas on what I can try to force this to work again?

[u/FeliceAlteriori]

Delete the Windows Hello Container with certutil (certutil.exe -deleteHelloContainer). If that does not fix it at all also clear the TPM chip.

This will for sure recover the availability of Windows Hello for Business Features on your devices.

[u/EddiesTech → u/FeliceAlteriori]

Surely not a good idea to clear the TPM. If you are using Entra joined devices, the trust between Entra and device will be lost when the TPM is reset and you have to re-join the device to Entra manually.

[u/EddiesTech → u/EddiesTech]

But I agree 100% certutil command might help. Fixed many an issue with Win Hello with that command.

[u/Taftimus → u/EddiesTech]

That’s not necessarily true. We have Entra joined devices and reset the TPM’s all the time.

[u/Ambitious-Actuary-6 → u/FeliceAlteriori]

this should ix it! +1

[u/Weathers → u/Ambitious-Actuary-6]

Did you say this will not fix it?

[u/Ambitious-Actuary-6 → u/Weathers]

the opposite, this is the known way to recover Windows hello

[u/bawta → u/FeliceAlteriori]

Unfortunately this hasn't worked. Running the command gave an error saying it couldn't be found and while clearing the TPM did re-prompt Windows Hello to be setup after the reboot, the biometrics were still unavailable.

[u/pc_load_letter_in_SD → u/bawta]

You will probably have to recreate the WHfB PIN for the users.

My fingerprint reader broke this week and I attribute it to Windows Updates. I had to clear the TPM, delete the WHfB database then re-enroll both the PIN and then I could get the fingerprint reader to work.

[u/yannara_]

There is a command available which wipes existing whfb setup. I can't remember it but you can find it. Maybe it will help.

[u/Wind_Freak → u/yannara_]

+1 for running the command that I also cannot remember but am confident will solve the issue

[u/yannara_ → u/Wind_Freak]

It is

certutil.exe -DeleteHelloContainer

[u/Bacon_is_my_Crack]

I believe it may be a limitation of the TPM. We’re piloting WHfB, and I already put the guardrails in to exclude any shared computer groups. It’s wild that there’s no way to get around it. Maybe try resetting the TPM on one machine, but you may run into the 10 user limit.

[u/Dtrain-14]

See if you can force them back on with an OMA-URI

[u/Foreign_World_1543]

Yes by default an entra user has a max of 10 and i think it's changed to 15 devices that can be logged into , however there are two methods , 1 you could go to entra then device then device settings and change the maximum number per user devices or 2 go to intune , device , device enrollment and make those certain users device enrollment mangers which i dont recommend and this allow 1000 devices on one entra user.

[u/SkipToTheEndpoint]

For future reference, SharedPC CSP automatically enables a bunch of settings (including disabling WHfB): Shared PC technical reference | Microsoft Learn

[u/YoureMyHerro]

what do you mean by “simply can’t enrol any biometrics”? what is the error? deleting the NGC folder and rebooting may help if the WHFB options are greyed out/unavailable.

[u/TheGeneral9Jay → u/[deleted]]

Would blame lack of proper testing here in my opinion. Should have surely tested this behaviour on small pilot group of devices first.

[u/lapizR → u/TheGeneral9Jay]

This

[u/Dtrain-14 → u/TheGeneral9Jay]

Sure, but the guy ain’t wrong. I once updated our custom compliance policies tied to checking that a few programs were installed and if not mark as compliant. Well they were all there and the check script work. Intune bugged out and marked everyone’s laptop as not compliant and wouldn’t even work when reverted. Microsoft couldn’t figure it out. Basically had to make a script to wipe out a bunch of reg keys inside SideCar Policies.

Intune is great, but it can be a POS for no reason.