How to Enable or Disable Windows Hello Biometrics for Domain Users

Turn On or Off Windows Hello Biometrics Using Local Group Policy Editor

The Local Group Policy Editor, a Windows tool, directly controls advanced settings. This tool manages whether Windows Hello biometrics function for domain users.

Step 1Open Local Group Policy Editor

Press Windows key + R on your keyboard. Type gpedit.msc and press Enter.

Step 2Find the Biometrics Settings

The Local Group Policy Editor tool, which changes computer settings, displays a navigation path on its left. Administrators use this path to manage Windows Hello biometrics. This path controls fingerprint or face login functionality for users on network computers, impacting over 100 million devices globally.

Computer Configuration → Administrative Templates → Windows Components → Biometrics

Step 3Change the Setting

You can control if domain users can sign in with Windows Hello biometrics by changing the ‘Allow domain users to log on using biometrics’ setting. This setting is found in the Biometrics folder within your computer’s settings.

Now select one of these options:

• Not Configured – This means biometrics are allowed.
• Enabled – Biometrics will be allowed for domain users.
• Disabled – Biometrics will NOT be allowed for domain users.

Clicking OK saves the biometric setting changes. Restarting the computer applies these biometric changes for domain users, ensuring Windows Hello fingerprint and facial recognition settings are active or inactive as intended.

Turn On or Off Windows Hello Biometrics Using Registry Editor

If you can’t use the Local Group Policy Editor (for example, on Windows Home editions), you can change the setting by editing the Windows Registry.

Step 1Open Registry Editor

Press Windows key + R. Type regedit and press Enter.

This guide, "How to Open Registry Editor in Windows 11," provides additional information. Registry Editor in Windows 11 allows advanced users to change system settings by editing the Windows Registry, a database that stores low-level settings for the operating system and applications.

Step 2Navigate to the Biometrics Key

Go to this folder path:

If the Biometrics folder does not appear under the Microsoft folder, create this folder. This action ensures that Windows Hello biometrics settings can be properly managed for domain users. The presence of the Biometrics folder is required for the subsequent configuration steps.

1. 🖱️ Right-click on Microsoft → New → Key.
2. Name the new key Biometrics.

Step 3Create or Edit the “Enabled” Value

To set up Windows Hello biometrics for domain users with the Registry Editor, you’ll create or edit a value called ‘Enabled’ in the Biometrics folder. This lets you turn biometrics on or off for domain accounts.

Name this new value Enabled.

Double-click the Enabled value. Set the Base to Decimal. Then set the Value data to:

• 1 to turn ON biometrics for domain users.
• 0 to turn OFF biometrics for domain users.

Press OK and close the Registry Editor.

🔄 Restart your computer to apply these changes.

Summary

Windows Hello biometrics offers secure sign-in using face, fingerprint, or PIN. Administrators can manage these sign-in options for domain users on a PC. If a PC joins a domain, these sign-in options might be turned off by default. Users can easily turn Windows Hello biometrics on or off.

If your PC is part of a domain (like work or school), these sign-in options might be turned off by default.

You can turn Windows Hello biometrics on or off for domain users by using either the Local Group Policy Editor or the Registry Editor.

Remember to 🔄 restart your computer after making any changes.

If you want to learn more about Windows Hello features, here are some helpful guides:

How to Sign In with a PIN in Windows 11

How to Use Facial Recognition in Windows 11

How to Sign In with Your Fingerprint in Windows 11