I'm looking to implement Windows Hello for Business in an on-premises environment from scratch. I understand that I need to establish a Public Key Infrastructure (PKI) environment to utilize the Group Policy Objects (GPOs) for Windows Hello for Business, but I'm not sure about the key considerations for doing this.
Specifically, I want to know:
- Should I invest in a dedicated physical server for the offline certificate authority, or is a virtual machine on our existing host server sufficient?
- Are there risks of disrupting normal authentication processes during this setup?
- Could this impact users in any significant way?
- What additional questions should I be asking, considering my limited knowledge on the subject?
Ultimately, my goal is to enable users to utilize fingerprint recognition on their laptops and manage passkeys effectively.
1 Answer
There's actually a cloud Kerberos model available that’s way easier to set up than the certificate model. It works really well without any hassle. If you're interested, check out the official guide for details!
We don't have Entra ID, though.