We have rolled out Windows Hello for Business with a required PIN and optional fingerprint or face recognition. Is there a way to report which users have set up only the PIN so we can follow up about biometric adoption?
Can I report on users who only use a Windows Hello for Business PIN?
Asked by
m613!parcel_8
Answers
Look at the local Windows Hello logs as a starting point. The distinction matters here: a registered method tells you what was set up, while a last-used method only tells you what was used most recently. Someone who last signed in with a PIN could still have biometrics enrolled.
For an organization-wide report, you would need to collect the relevant information from devices and work out how to associate it with users. Check the Microsoft guidance on registered methods and last-used methods for the available detail.
Reply to this answer
The LogonUI registry keys are another place to investigate on the endpoints. I would validate what they show against a few known PIN-only and biometric setups before relying on them for a user adoption report.
Reply to this answer
If the goal changes from encouraging enrollment to requiring an extra unlock factor, take a look at Windows Hello for Business trusted signal unlock policy. That is a policy route rather than a report of who has enrolled biometrics, so check the configured factors against what you actually want to require.
Reply to this answer
Add your answer
Answers are reviewed before publication.
v52+addrhook_804:
Device-level results may need some care if users sign in on more than one machine. A PIN-only setup on one device does not necessarily describe every device they use.