Forum Discussion
How to see which users only implement the pincode in Windows Hello?
We rolled out Windows Hello for Business in the whole organisation. All users see a Windows Hello for Business wizard where the at least need to implement the pincode. It is possible to implement also the fingerprint or face recognizing. How can I generate some report where I can see the implemented Windows Hello methods? We would like to contact everybody who only implemented the pincode to do some user adoption.
2 Replies
Hi Khalid,
That information lives locally on the endpoint in the registry and is not synced up to Entra ID or Intune by default, so it cannot be pulled from a portal report.
The practical way to get this at scale is an Intune Proactive Remediation script pair (detection + optional remediation) that reads the relevant registry values on each device and reports back the registered WHfB methods and the last-used method. There is a published example built on top of scripts originally written by Marius Wyss, available here:
https://github.com/MrWyss-MSFT/Intune-Remediation-Scripts (WH4B / Enrolled Methods folder)
You run it as a detection script across your device population through Intune and it surfaces per-device results (PIN only, PIN + fingerprint, PIN + face, etc.) that you can then export and filter for the "PIN only" group to target for adoption outreach.
This reads local device state, so a user with multiple enrolled devices may show differently on each one, and you would want to decide whether "PIN only everywhere" or "PIN only on primary device" is the bar for your outreach list.
There is no tenant report that separates users with only a PIN from those who added face or fingerprint. Windows Hello for Business registers a device-bound key with Entra ID; PIN and biometric gestures unlock that same credential. Biometric templates remain on the device and do not roam, so Entra and Microsoft Graph can report Windows Hello for Business registration, but not configured local gestures.
In Entra admin center, open Protection > Authentication methods > Activity > Registration details and export the report to identify registered users. It cannot identify PIN-only users. A PIN also remains the fallback when biometrics are configured.
For adoption outreach, target all users registered for Windows Hello for Business, or collect device-local enrollment status with an approved endpoint-management script after privacy review. Do not infer biometric enrollment from sign-in logs, because the service sees the same key authentication regardless of which gesture unlocked it.
