How to Manage Windows Hello Facial Recognition in Windows 11

Windows Hello is a secure alternative to a standard password. You can sign in with a PIN, a security key, or facial recognition. In this tutorial you will remove facial recognition as a sign-in option and as a User Account Control (UAC) credential provider, and learn how to bring it back.

Windows offers several ways to sign in to your device, and Windows Hello is one of the more secure ones. It gives you a more personal way to sign in using a PIN, facial recognition, fingerprint, passkey, and more. Facial recognition also needs a compatible camera, so not every device can use it.

You can also use a security key. This is a hardware device, usually a small USB key, that you use instead of your username and password to sign in on the web.

A password alone is the least secure of these methods.

Windows Hello facial recognition is more secure than a password, but it does not suit every situation. Some environments remove it as a sign-in option and as a UAC credential provider. Once removed, nobody can use facial recognition to sign in on the Windows Sign-in screen, or as a UAC credential provider when an app asks for elevation.

There are a few reasons you might add or remove facial recognition. It is quick and convenient, because you can sign in without typing a password each time.

It also has limits. It may not work reliably if you wear a mask or another covering that hides your face. Some organizations have security policies that prohibit it. In those cases, remove facial recognition and use another method, such as a PIN, a password or a security key.

How to add or remove Facial Recognition as a Sign-in option

If you want to stop users from signing in with their faces, or you need to standardize the sign-in process across several accounts, you can remove the ability to use facial recognition. The change is made in the registry, so you need an account with administrator rights. The steps are the same on Windows 11 Home and Pro.

Editing the registry incorrectly can cause problems. Before you start, back up the key you are about to change. In Registry Editor, select the key, then choose File › Export and save the file somewhere safe.

1. Open Windows Registry Editor. Approve the User Account Control prompt if one appears. You should see the Registry Editor window with a folder tree on the left.
2. In the left pane, go to the registry key shown below.

ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential Providers{8AF662BF-65A0-4D0A-A540-A338A999D36F}

3. In the right-hand pane of the Explorer key, double-click the Disabled (REG_DWORD) entry. Its properties dialog opens.
4. In the Value data box, enter 1 and click OK. This stops users from using facial recognition in Windows.

If you don’t see a Disabled entry, you need to create it:

1. Right-click an empty space in the right-hand pane.
2. Select New › DWORD (32-bit) Value. A new entry appears with its name highlighted for editing.
3. Type Disabled as the name and press Enter.
4. Double-click the new entry, enter 1 as the value data and click OK.

You may have to restart your computer for the change to take effect. If facial recognition still appears as an option after the restart, reopen Registry Editor and check that you edited the correct key and that the value is exactly Disabled.

To undo the change and allow facial recognition again, delete the Disabled value. Right-click it, select Delete and confirm. Restart the computer if the option does not come back straight away. If you exported the key first, you can also double-click the saved file to restore it.

Reference:

Microsoft

Conclusion:

• Windows Hello facial recognition is a secure and convenient sign-in option. It lets you get into your device quickly without entering a password every time.
• It can be impractical in some cases, such as when a facial covering hides your face or when organizational security policies rule it out.
• By following the steps above, you can remove Windows Hello facial recognition as a sign-in option and UAC credential provider, and restore it later by deleting the Disabled value. That gives you control over the Windows sign-in process.
• If you have feedback or additional insights, leave them in the comments to help improve this article.