We're preparing Windows Hello for Business for hybrid-joined devices using Cloud Kerberos Trust. Our concern is that someone could observe or obtain another employee's PIN and use it to unlock that person's computer while they are away. Biometrics-only authentication would be difficult on our desktop fleet, and Windows Hello still requires a PIN as a fallback. We're testing fingerprint readers, but the user experience has not been ideal. FIDO2 security keys are another possibility, although their cost and the risk of users leaving them connected to unattended computers are concerns. What practical technical or administrative controls would you recommend for this scenario?
3 Answers
If the risk is high enough to require an unshareable authenticator, consider smart cards or FIDO2 security keys and define clear handling rules. Those options can improve assurance, but they introduce cost, enrollment, replacement, and user-behavior issues. For most offices, enforcing automatic screen locking, short idle timeouts, and disciplinary controls is more practical than deploying expensive hardware solely to address an unverified concern.
There isn’t a true biometrics-only Windows Hello for Business design where the PIN disappears completely; the PIN remains an important recovery or fallback method. You can add fingerprint or facial authentication where the hardware supports it, but users should still be required to lock the device when leaving it unattended. Conditional Access, session reauthentication, and appropriate workstation lockout settings can limit exposure, but they won’t replace physical security.
This is primarily a management and security-policy issue rather than something Windows Hello can solve. Users should lock their workstations whenever they step away, and deliberately using another employee’s credentials should have clear consequences. Don’t make the deployment unnecessarily complicated because of a hypothetical scenario—set expectations, enforce them, and investigate actual incidents.
Exactly. The same concern applies to passwords, smart cards, and security keys. A technical control can reduce risk, but it cannot replace a policy against using someone else’s account.
Before choosing a costly solution, establish whether this has actually happened and estimate the business impact. A low-likelihood scenario may be adequately addressed with workstation-locking controls and an enforced acceptable-use policy.