I'm preparing Windows Hello for Business for hybrid-joined devices using Cloud Kerberos Trust. One concern is that someone could observe or obtain another employee's PIN and use it to access that person's unattended workstation.
Biometrics-only authentication would be attractive, but fingerprint peripherals for desktop systems are not always practical, and the PIN still exists as a fallback. We are also considering FIDO2 security keys, although their cost and the possibility of users leaving them connected create additional concerns. What technical controls or policies would you recommend for reducing this risk without making authentication too difficult for users?
3 Answers
Start with a risk assessment before making authentication unnecessarily complicated. Establish whether unauthorized access has actually happened, estimate the consequences, and then apply controls such as automatic locking, conditional-access policies, MFA step-up prompts, and monitoring for suspicious sign-ins. For most offices, a clear policy with real enforcement plus automatic screen locking is more practical than trying to make Windows Hello biometrics-only.
This is primarily a management and physical-security issue, not something Windows Hello can completely solve. Users should lock their workstations whenever they step away, and deliberately using someone else’s credentials should have clear, enforced consequences. Technical controls can reduce the opportunity, but they cannot compensate for employees intentionally sharing or misusing authentication information.
Windows Hello for Business is designed to make the PIN local to the device and protect the user’s credentials; it is not meant to stop someone who has learned the PIN from using an unattended, unlocked or accessible computer. Set a reasonable PIN policy, require workstation locking, and consider short inactivity timeouts or session reauthentication where the risk justifies the inconvenience. A complex PIN that users write down may create more risk than a memorable one combined with good physical-security practices.
The PIN is not simply the user’s password, but knowing it can still unlock that device and use the credentials protected by Windows Hello. It should therefore be treated as a device-specific secret and never shared.