How to Purge Stored Biometric Signature Databases in Windows 11 Sign-in Options

How Windows Stores Your Face and Fingerprint Data

Windows does not keep photos of your face or images of your fingerprints. When you enroll, it turns the scan into a mathematical template, which is a block of encoded data. It then encrypts that template and stores it in the protected folder mentioned above. Each template is tied to your user account and your device.

On many modern PCs, the matching work and the template protection happen inside dedicated security hardware, such as the TPM (a security chip on the motherboard) or the sensor’s own secure chip. The exact arrangement depends on your hardware. Where it applies, ordinary programs cannot read the data, even with administrator rights.

The practical result is that you cannot browse to these records and open or edit them. You manage them through the built-in Windows tools, which means the Sign-in options page in Settings. You can add, improve or remove a template there, but not view it.

Preparing to Delete Your Biometric Data

Before you remove anything, make sure you can still get into the computer without your face or finger. Once the biometric data is gone, Windows falls back to your password or PIN for every sign-in and every identity check.

1. Confirm that you know your account password. If you sign in with a Microsoft account, this is your Microsoft account password.
2. Confirm that you know your PIN. If you are not sure, type it at the lock screen next time as a test.
3. Check that you are signed in with the account whose data you want to remove. Biometric templates belong to each user separately, so removing yours does not touch anyone else’s.
4. If other people use the PC, tell them you are changing sign-in settings. That avoids confusion if something looks different on the lock screen.

Passkeys are another way to sign in. A passkey is a sign-in credential stored on your device that replaces a typed password. On Windows 11 it is normally unlocked with Windows Hello, so after you remove your face or fingerprint, Windows asks for your PIN instead.

The Settings method below does not need administrator tools. The manual folder method does. Stopping the Windows Biometric Service and deleting the database files requires an elevated administrator account, because the folder is protected by system permissions. A standard account cannot do either.

How to Remove Fingerprint and Face Data Using Settings

This is the standard method. It takes a few clicks and needs no administrator tools, although some prompts may ask you to verify who you are.

1. Open the Start menu and select Settings. You can also press the Win plus I. The Settings⚙️ window opens.

2. Click Accounts in the left-hand menu. The account options appear on the right.
3. Select Sign-in options from the list on the right. The path is Settings › Accounts › Sign-in options. You now see the ways you can sign in, such as face, fingerprint, PIN, security key, password and, on current builds, passkeys.

4. Scroll down to Facial recognition (Windows Hello) or Fingerprint recognition (Windows Hello). Each one appears only if Windows detects a compatible camera or reader.
5. Click the feature you want to remove. Its panel expands and shows the available options, such as Improve recognition, Add another finger or Remove. For face, there is one Remove button. In newer builds the fingerprint panel offers Remove for each enrolled finger, so repeat the step for every finger.
6. Click the Remove button. If Windows asks for your PIN or password, enter it to confirm.
7. Check that the panel now offers Set up again instead of Remove. That tells you the data is gone.

That’s it. Windows deletes the stored data for that feature straight away, and there is no undo. To get face or fingerprint sign-in back, click Set up and enroll again whenever you are ready.

If you cannot find the section, or the Remove button is missing or greyed out, check these things:

• There may be no compatible camera or fingerprint reader, or its driver may not be working. Check Device Manager and Windows Update. On some PCs, Sign-in options also offers Sign in with an external camera or fingerprint reader, which you can use if the built-in device is faulty.
• Nothing may be enrolled yet, so there is nothing to remove.
• A work or school policy may be managing Windows Hello. In that case your administrator controls it.

Home and Pro editions use the same steps here.

Create a restore point or a full backup first. Deleting these files can break Windows Hello sign-in for all users on the PC, not only your account. Do this only from an elevated administrator account, and expect everyone to enroll again afterwards.

Advanced Management: Using Enhanced Sign-In Security

Enhanced Sign-in Security (ESS) is an extra protection layer in Windows 11. It isolates the face or fingerprint sensor and the matching process from the rest of the operating system, using specialised hardware and software working together. Its goal is to stop malicious software from capturing or tampering with your biometric data as it travels from the sensor to the processor.

Not every PC supports it. It needs compatible hardware and firmware, and the sensor itself must be designed for it. Devices that meet those requirements turn the protection on automatically, so there is normally nothing for you to configure.

To check what your system reports:

1. Open Settings and click Privacy & security.
2. Select Windows Security and review what it reports about your device.
3. Go back to Settings › Accounts › Sign-in options. On supported devices, you may see a setting named Sign in with an external camera or fingerprint reader.

You should now know what your PC reports about this protection. Not every device shows the same information. Removing your biometric data does not switch ESS off, and re-enrolling later keeps the same protection in place.

Summary

Removing stored biometric data through Sign-in options is a quick, dependable way to protect your privacy. It suits selling a PC, retiring an old account or fixing a misbehaving reader. The built-in Settings app deletes your face and fingerprint templates for good, and you can enroll again at any time. A PIN or a passkey keeps you signed in while you do.

Take a minute to check your current sign-in options and remove any old or unused face or fingerprint entries. For more help with Windows 11 security, see our other guides on user accounts and system protection.