Forum Discussion
Disable "Windows Hello"
It can be done if you have Intune licenses.
If you haven't any, I suggest the workaround as following
First Setup a Intune trial
https://docs.microsoft.com/en-us/intune/fundamentals/free-trial-sign-up#sign-up-for-a-microsoft-intune-free-trial
assigning one license to a random user, so we gain access to the Intune portal
https://devicemanagement.microsoft.com
Go to Devices > Windows > Windows Device enrollment
https://devicemanagement.microsoft.com/#blade/Microsoft_Intune_DeviceSettings/DevicesWindowsMenu/windowsEnrollment
Click on Windows Hello for Business and at the bottom, at the "Configure Windows Hello for Business" select Disable, Apply
Please be advised to cancel the trial after completing this steps, so you will not be billed in the future.
Note: The Intune portal might change time to time, (design, arrangements )
EdmirTaipi I just tried but unfortunally it didnt work either.
So i've tried 3methods
Method 1: Using Group policy settings.
If you are on Windows 10 Pro edition, you can change the group policy settings to disable PIN sign-in option for all users.
Open the Run dialog box by pressing the Windows key and the R key together.
Type GPEDIT.MSC and hit the Enter key.
Go to Computer Configuration -> Administrative Templates -> System -> Logon.
On the right side, double click on Turn on PIN sign-in and select Disabled.
Similarly disable the other Windows Hello options if any.
Exit the Group policy editor and reboot the computer.
Method 2: Disabling Windows Hello in Registry.If setting Group policy doesn’t work, you may disable the sign in options which should disable
Windows Hello options in all user accounts.
Disclaimer: The registry is a database in Windows that contains important information about system hardware, installed programs and settings, and profiles of each of the user accounts on the computer. Windows often reads and updates the information in the registry.
Normally, software programs make registry changes automatically. You should not make unnecessary changes to the registry. Changing registry files incorrectly can cause Windows to stop working or make Windows report the wrong information.
Please take a backup of the registry. Follow the steps given in the link below:
https://support.microsoft.com/en-in/help/322756/how-to-back-up-and-restore-the-registry-in-windows
Open the Run dialog box by pressing the Windows key and the R key together.
Type Regedit and hit the Enter key.
When the Registry Editor opens, navigate to the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Settings\AllowSignInOptions.
In the right pane, double click on the DWORD entry named value set it to 0.
Method 3:
First Setup a Intune trial
https://docs.microsoft.com/en-us/intune/fundamentals/free-trial-sign-up#sign-up-for-a-microsoft-intune-free-trialassigning one license to a random user, so we gain access to the Intune portal
https://devicemanagement.microsoft.com/Go to Devices > Windows > Windows Device enrollment
https://devicemanagement.microsoft.com/#blade/Microsoft_Intune_DeviceSettings/DevicesWindowsMenu/windowsEnrollmentClick on Windows Hello for Business and at the bottom, at the "Configure Windows Hello for Business" select Disable, Apply
Intune/MS Endpoint Manager works, but it's another setting you're looking for.
Endpoint Security/Account protection -> Create Policy -> Policy Type: Account protection (Preview)
Here you have the setting "Block Windows Hello for Business". Set it to Enabled and push the policy to your devices and/or users. Worked perfectly for our customers.
Most likely one can find the same setting in a Configuration Profile. The relevant CSP is PassportForWork: https://docs.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp
I just want to burn everything that has to do with Windows Hello with a blowtorch.
Why do they do this? When they do **bleep** like this I honestly feel like signing every single microsoft center up to scientology, jehovas witnesses, other various spam packages and see how they like being bombarded with CRAP noone asked for. F*** OFF!
My problem with it is that it's invasive. At no point are you asked if you want to activate it and there's no obvious way to disable it. I could probably disable it if I had the time, but for gods sake. Why force it upon people without asking? It's dirty practices and deserves to be spat on.
- It has to do with safety on the Identity side of things. Identity is the new control plane and those looking to just secure their perimeter are obviously not getting the point of a Cloud Connected world. Windows Hello brings great benefit to user simplicity when it comes to logging on and security through conditional access for instance. I'd be happy to point you to the right articles for a better understanding. Start with this one: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification
- I agree!
