Forum Discussion

Steve Whitcher's avatar
Steve Whitcher
Bronze Contributor
Jul 24, 2018
Solved

Logging on to Remote Desktop using Windows Hello for Business & Biometrics

In the release notes for build 17713, support was announced for logging into remote desktop sessions using biometrics via windows hello.  I have a few questions I'm hoping someone can answer:   The...
jurajt's avatar
jurajt
Brass Contributor
Jun 12, 2019
has this been resolved? is it possible to use WhfB PIN (not certs!) to RDP login into a windows server joined to Azure AD Domain Services?
Clint Lechner's avatar
Clint Lechner
Iron Contributor
Jun 12, 2019

jurajt  Nope, not as far as I know.  If it was resolved, and key-trust worked with RDP, I would be chugging margaritas and dancing on tables.

  • Christoph Berthoud's avatar
    Christoph Berthoud
    Copper Contributor
    Jun 12, 2019

    Sadly it still hasn't been fixed, and there is still little information available. I'm engaging Microsoft under our Unified Support to better understand what's happening in this space.

    • Clint Lechner's avatar
      Clint Lechner
      Iron Contributor
      Jun 13, 2019
      As of a few weeks ago there wasn't any action and we were speaking with senior engineers. The documentation that states that ADFS is an absolute requirement with key trust is because of our case unfortunately.

      Previously there was some gray area where it was thought that AD Connect would be sufficient. Our original thought was that we would go passwordless with Windows hello for business combined with phone sign in for Office 365 Authentication, on the back of multi-factor Authentication width required biometric login.

      We actually rolled it out with incredibly positive user feedback. We were heroes. And then RDP bit us in the arse.
      • Damien1234's avatar
        Damien1234
        Copper Contributor
        Nov 29, 2019

        Clint LechnerThat AAD Connect comment was gold.  I was fuzzy too as it seemed no RA was required for the key trust model.  Regardless, based on all these comments, the idea that I might be able to get away with the key-trust model seems to be out the window especially since we have a brand new requirement to deploy a single new RDP based PAW (Privileged Access Workstation) that should only be accessed with WHfB credentials.  All I can say is I'm lucky all our servers are 2019 and workstations Win 10/1909.  Now to build the lab!  Krikey!

Resources