I want to enforce hardware-based login on a few Windows office computers used by executives and other higher-privilege employees. Ideally, a user would tap an NFC-capable YubiKey on a reader near the office entrance and unlock their assigned computer without entering another credential. The goal is to make secure login easier than the current setup, where some users write their Windows Hello PINs on sticky notes and occasionally encounter TPM-related PIN problems.
The computers are in inconvenient locations, so requiring users to crawl under their desks to insert and touch a security key would be impractical. I am considering mounting an NFC reader near the doorway so users can tap their key as they enter. Is NFC-based FIDO2 or smart-card login supported natively by Windows? Could one reader serve multiple nearby computers while identifying the correct user and unlocking the appropriate machine? I am also open to other passwordless approaches that would be secure but simple enough for users who strongly resist typing a PIN.
5 Answers
A shared reader cannot generally determine which of several computers it should unlock just because a particular key was tapped. Authentication is tied to the target workstation and the user's account, so each machine needs an appropriate reader or another supported sign-in path. A managed FIDO2 deployment or smart-card setup is likely to be more reliable than building a custom doorway system.
The technical problem may be easier than the human one. Anyone willing to leave a PIN on a monitor may also leave a security key in a reader all day, which can be worse. A key should be treated like a physical house key: it must stay with its owner and be reported immediately if lost. Training, clear incident procedures, and consequences for bypassing the process are important alongside passwordless authentication. Making login effortless is useful, but it should not eliminate every factor that protects the account.
Before adding hardware, fix the Windows Hello deployment. With a correctly configured Windows Hello for Business setup, PIN failures should be uncommon. Review TPM health, provisioning, and any legacy cryptographic settings that may conflict with newer Windows versions. For devices without cameras or fingerprint readers, a FIDO2 key is a reasonable passwordless option; laptops can use Windows Hello biometrics where supported.
What you are describing with government access cards is usually smart-card authentication rather than ordinary NFC FIDO2 login. YubiKey 5-series devices can support smart-card functionality, and Windows plus Active Directory have established smart-card support. Users will generally still enter a smart-card PIN, but the credential remains protected on the key. This is a more conventional design for Windows and server or RDP authentication than trying to make one NFC reader unlock several machines.
Windows supports passwordless sign-in with FIDO2 security keys through the appropriate Entra ID, Intune, Group Policy, and hybrid identity configuration. NFC readers can be used with compatible keys, but the reader does not normally act as a shared room-wide unlock device. The key generally needs to be presented to the computer that is logging in, and the user may still need to touch the key or provide its PIN depending on the configuration. Cloud Kerberos may also be needed for access to on-premises resources in a hybrid environment.
The main reason for considering NFC is to avoid keys being left permanently plugged into a computer, while also avoiding the need for users to reach behind their desks. A reader by the entrance seemed like the least disruptive option.
The desktop computers do not have suitable cameras or fingerprint readers, although the laptops already use those options. The desktop users are the group I am trying to accommodate.