How to Enable or Disable Windows Hello Biometrics for Domain Users
Windows Hello biometrics let you sign in to your Windows 11 work or school PC using your face, fingerprint, or a PIN instead of a standard password. Group Policy settings control these sign-in options on computers connected to a domain network, meaning your network administrator can turn the feature on or off for you.
Workplace networks sometimes block facial recognition and fingerprint sign-ins for security reasons, forcing you to use a traditional password instead. You can check your current setup or follow your company’s network rules to manage these sign-in choices on your computer.
Configure Windows Hello biometrics for domain users via Group Policy Editor or Registry Editor. Navigate to Administrative Templates Windows Components Biometrics in Group Policy, then adjust the “Allow domain users to log on using biometrics” setting. Alternatively, in Registry Editor, modify the “Enabled” DWORD value under 🗝️HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftBiometrics.
Turn On or Off Windows Hello Biometrics Using Local Group Policy Editor
The Local Group Policy Editor (a tool for configuring advanced system settings) directly controls whether Windows Hello biometrics function for domain users.
Step 1Open Local Group Policy Editor
Press the Win and R together, type gpedit.msc, and press Enter to launch the Local Group Policy Editor for managing Windows Hello biometrics.
Consult the “How to Open Local Group Policy Editor in Windows 11” guide for detailed steps on accessing this tool. Windows 11 Pro and Enterprise editions include this tool natively.
Step 2Find the Biometrics Settings
Navigate to the Biometrics category within the Local Group Policy Editor using this path: Computer Configuration Administrative Templates Windows Components Biometrics
Computer Configuration → Administrative Templates → Windows Components → Biometrics
Step 3Change the Setting
The 'Allow domain users to log on using biometrics' setting governs Windows Hello biometrics for network accounts. Choose 'Enabled' or 'Not Configured' to permit domain users to sign in with their face or fingerprint.
Select one of these options next:
- Not Configured – This means biometrics are allowed.
- Enabled – Biometrics will be allowed for domain users.
- Disabled – Biometrics will NOT be allowed for domain users.
Click OK to save the biometric setting changes. Restart your computer to apply the new policy.
Turn On or Off Windows Hello Biometrics Using Registry Editor
Windows Home editions lack the Local Group Policy Editor, requiring modifications through the Windows Registry instead.
Step 1Open Registry Editor
The Registry Editor (a database holding low-level configurations for the operating system and apps) handles these changes if Group Policy isn't available. Press the Windows key and R together, type regedit, and press Enter to open it.
Consult "How to Open Registry Editor in Windows 11" for additional information. Advanced users modify system settings using the Registry Editor.
Step 2Navigate to the Biometrics Key
Locate the Biometrics key in the Registry Editor to manage Windows Hello biometrics for domain users. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. Right-click Microsoft, select New, then Key, and name it Biometrics if that folder is missing.
Creating this folder ensures proper management of Windows Hello biometrics for domain users. The presence of the Biometrics folder is required for the subsequent configuration steps.
- Right-click on Microsoft → New → Key.
- Name the new key Biometrics.
Step 3Create or Edit the "Enabled" Value
Create or edit the 'Enabled' value within the Biometrics folder to control Windows Hello biometrics through the registry. Set the Base to Decimal and the Value data to 1 for enabling biometrics, or 0 for disabling them.
Name this new value Enabled.
Double-click the Enabled value. Set the Base to Decimal. Then set the Value data to:
- 1 to turn ON biometrics for domain users.
- 0 to turn OFF biometrics for domain users.
Click OK and close the Registry Editor.
Restart your computer to apply these changes.
Summary
Windows Hello biometrics offers secure sign-in options like face or fingerprint scanning. Administrators control Windows Hello settings for domain users. Work or school domain PCs may disable these features by default, but users can toggle them.
Work or school domains often disable these sign-in options by default. Local Group Policy Editor or Registry Editor modifications allow enabling or disabling Windows Hello biometrics for domain users.
Remember to restart your computer after making any changes.
Consult these helpful guides to learn more about Windows Hello features:
How to Sign In with a PIN in Windows 11
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!