how to disable windows hello for business

Question

how to disable windows hello for business

Jeffrey D. Fishman 0

Trying to remove windows hello from our login options

0 comments

2 answers

Your answer

Answer 1

To remove Windows Hello for Business from sign-in and stop it from being (auto) enabled, configure policy to disable it and, if needed, remove existing Hello credentials.

Disable Windows Hello for Business via policy/registry

Use one of these supported options to turn off Windows Hello for Business so it no longer enrolls or is required:

Tenant / Intune / MDM (PassportForWork CSP – device scope):
Set the following registry value to 0 (disable):
- Key path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\<Tenant-ID>\Device\Policies
- Key name: UsePassportForWork
- Type: REG_DWORD
- Value: 0 to disable ( 1 enables)
Tenant / Intune / MDM (PassportForWork CSP – user scope):
Set the following registry value to 0 (disable):
- Key path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\<Tenant-ID>\UserSid\Policies
- Key name: UsePassportForWork
- Type: REG_DWORD
- Value: 0 to disable ( 1 enables)
Group Policy – device scope:
Configure the Use Windows Hello for Business policy (or its backing registry) to disabled:
- Key path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork
- Key name: Enabled
- Type: REG_DWORD
- Value: 0 to disable ( 1 enables)
Group Policy – user scope:
- Key path:
  HKEY_USERS\<UserSID>\SOFTWARE\Policies\Microsoft\PassportForWork
- Key name: Enabled
- Type: REG_DWORD
- Value: 0 to disable ( 1 enables)

If both device and user policies exist and conflict, the user policy takes precedence. Avoid creating local GPO/registry that conflicts with MDM, as this can cause unexpected behavior.

If devices are Microsoft Entra joined and you want to stop automatic enrollment entirely, use one of these supported options:

Disable Windows Hello using the tenant-wide policy.
In Intune, configure Use Windows Hello for Business to Disable (for example via the supported policy types) and, if using the Enrollment Status Page (ESP), ensure ESP blocks desktop access until this policy is applied.
Provision devices with a provisioning package that disables Windows Hello for Business.
Use scripted solutions during OS deployment to set the above registry values to disable Windows Hello for Business.

Disable automatic enrollment in cloud-only deployments

In a cloud-only Microsoft Entra join scenario, Windows Hello for Business is enabled and enrollment is attempted by default. To disable automatic enrollment:

Follow the guidance under Disable Windows Hello for Business enrollment and set the UsePassportForWork / Enabled values to 0, or use the tenant-wide / Intune policies described above.
Note: During OOBE for Microsoft Entra join without Intune, the PIN setup screen can be cancelled to reach the desktop without enrolling in Windows Hello for Business.

Remove existing Windows Hello credentials from devices

After policy is set to disable Windows Hello for Business, existing credentials can be removed from each device:

Users can remove Windows Hello sign-in options (PIN, face, fingerprint) from:
Start > Settings > Accounts > Sign-in options, select the Windows Hello method, then Remove. This unenrolls the user and deletes the associated biometric template database file on that device.
To delete the Windows Hello for Business container on a device (for example, as an admin cleanup step), run:
certutil.exe -deleteHelloContainer

Once policies are applied and existing credentials removed, Windows Hello for Business will no longer be offered or used as a sign-in method on those managed devices.

References:

Answer 2

Hello,

Windows Hello for Business is integrated into the OS and domain policies, so disabling it depends on whether you are in a standalone environment or Active Directory/Azure AD. On a domain‑joined or hybrid setup, the most reliable way is through Group Policy or Intune configuration.

For Group Policy, open the Group Policy Management Console and navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business. Set the policy Use Windows Hello for Business to Disabled. This prevents provisioning and removes it from login options. If you are using Azure AD or Intune, the equivalent setting is under Device Configuration > Windows Hello for Business where you can set it to “Disabled” or “Not Configured.”

On standalone machines, you can disable it by editing local group policy (gpedit.msc) in the same path. If Windows Hello has already been provisioned, you may also need to clear existing credentials. That can be done by deleting the contents of %ProgramData%\Microsoft\Ngc after disabling the policy, which removes stored PINs and Hello keys.

Be aware that if you are in a hybrid Azure AD environment, disabling Hello for Business may affect compliance baselines or conditional access policies that expect strong key‑based authentication. In those cases, you should coordinate with your identity/security team before disabling it globally.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.