Policy
Use Windows Hello for Business
Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable this policy, the device provisions Windows Hello for Business using keys or certificates for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. If you do not configure this policy setting, users can provision Windows Hello for Business as a convenience credential that encrypts their domain password. Select "Do not start Windows Hello provisioning after sign-in" when you use a third-party solution to provision Windows Hello for Business. If you select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business does not automatically start provisioning after the user has signed in. If you do not select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business automatically starts provisioning after the user has signed in.
5589606dca43 MSPassport_UsePassportForWork Registry
Copy registry mappings
HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Enabled (enabled) = 1
HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Enabled (disabled) = 0HKCU\SOFTWARE\Policies\Microsoft\PassportForWork\Enabled (enabled) = 1
HKCU\SOFTWARE\Policies\Microsoft\PassportForWork\Enabled (disabled) = 0HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\DisablePostLogonProvisioningHKCU\SOFTWARE\Policies\Microsoft\PassportForWork\DisablePostLogonProvisioningPolicy notes
Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable this policy, the device provisions Windows Hello for Business using keys or certificates for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. If you do not configure this policy setting, users can provision Windows Hello for Business as a convenience credential that encrypts their domain password. Select "Do not start Windows Hello provisioning after sign-in" when you use a third-party solution to provision Windows Hello for Business. If you select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business does not automatically start provisioning after the user has signed in. If you do not select "Do not start Windows Hello provisioning after sign-in", Windows Hello for Business automatically starts provisioning after the user has signed in.