Forum Discussion
WHFB - Intune - Only PIN works and it causes print issues
Hello,
I have personally attempted to deploy this for my environment and so has a colleague.
We deploy windows hello specifically to a single machine or user, the PIN ends up being the only option which can be used, the device will say every other option is not available. It will constantly pop up at the bottom right that the password needs to be put in again to authenticate the user and printing will not work at all.
The devices are fully capable of using facial recognition.
Has anyone encountered any of these issues in a similar fashion with an AD > Entra environment ?
Thank you,
Jamie.
4 Replies
I would really check what WinEndpointOps said. But as far as I understood, do you have hybrid joined state for your machines? If so, I would suggest to check whether you may have any conflicts between GPO and Intune policies.
If you have deleted any WHFB policies created on AD, they still may apply and need a manual deletion from registry to work properly.
What does Event Viewer say in the User Device Registration log (found in Application and Services Logs -> Microsoft -> Windows).
Jamie, one way to confirm the print side before and after you change anything: sign in with the PIN and run dsregcmd /status. Under SSO State, check that AzureAdPrt is YES and that OnPremTgt is YES. If OnPremTgt is NO, Windows isn't getting an on-prem Kerberos ticket from the Hello sign-in, which matches the repeated password prompt and failing prints to an on-prem print server. Cloud Kerberos Trust is what fixes that for hybrid users, and klist shows the ticket once it works.
On face recognition, that's separate and policy-controlled. In the Windows Hello for Business policy, check that Use biometrics is set to Yes (or Not configured). If it's set to No, only the PIN will be offered even on cameras that support it. Each user also has to enroll their face under Settings > Accounts > Sign-in options.
Did it work before? Do you have SSO enabled for seamless authentication through WHfB? Are the users hybrid? If yes, then you can consider configuring CloudKerberosTrust.
Hello,
users use SSO, they are hybrid although I will look into cloud kerberos trust.
Thank you.
