This tutorial will show you how to enable or disable Enhanced Sign-in Security for all users in Windows 11.
Windows Hello enables biometrics or PIN authentication, eliminating the need for a password. Biometric authentication uses facial recognition or fingerprint to prove a user's identity in a way that's secure, personal, and convenient.
Malicious users and attackers constantly try to come up with new ways to access your device and access sensitive information. To stop them, you need a secure sign-in process that begins at the biometric sensor, and ends where your profile is stored.
Enhanced Sign-in Security (ESS) provides an additional level of security to biometric data with the use of specialized hardware and software components. Virtualization Based Security (VBS) and Trusted Platform Module 2.0 are used to isolate and protect user's authentication data, and to secure the data communication channel.
Since the ESS ecosystem is tightly controlled, introducing new items like plug-in cameras and fingerprint readers (FPR) may open the door for potential malicious users to access your biometrics. This is why you can’t use your external camera or FPR to sign into a device that has ESS enabled.
There are some situations where you may want to use an external peripheral for signing in, for example if you use your laptop on a docking station. In such cases, you won't be able to use the external peripheral for sign in, unless you disable ESS. The tradeoff of disabling ESS is that you lower the security of your device.
ESS System requirements
Compatible hardware and software components are required to enable Enhanced Sign-in Security:
- Meet the requirements for Virtualization-Based Security (VBS), including Device Guard Enablement and Trusted Platform Module 2.0
- Biometric sensor hardware that supports ESS
- Biometric sensor drivers compatible with ESS
- Device firmware with a Secure Devices (SDEV) ACPI table configured by the device manufacturer for the included biometric hardware
When ESS is enabled, you can still use your external camera with applications like Teams. Such apps don’t rely on biometrics for authentication.
When ESS is disabled, you can use Windows Hello compatible peripherals to sign in.
References:
Sign-In Options in Windows | Microsoft Support
Learn about the sign-in options in Windows settings.
support.microsoft.com
Enhanced Sign-in Security in Windows - Microsoft Support
Learn about Enhanced Sign in Security (ESS) and how to configure it.
support.microsoft.com
Windows Hello Enhanced Sign-in Security
Windows Hello Enhanced Sign-in Security provides your organization an additional level of security using biometrics or PIN.
learn.microsoft.com
Copilot+ PCs have ESS enabled by default.
You must be signed as an administrator to enable or disable Enhanced Sign-in Security.
After you enable or disable Enhanced Sign-in Security (ESS), users will have to sign in next time with their password or PIN, and set up their face and/or fingerprint again after signing in.
Contents
- Option One: Enable or Disable Enhanced Sign-in Security in Settings
- Option Two: Enable or Disable Enhanced Sign-in Security using REG file
1 Open Settings (Win+I).
2 Click/tap on Accounts on the left side, and click/tap on Sign-in options on the right side. (see screenshot below)
3 Under Additional settings, turn On (disable ESS) or Off (enable ESS - default) Sign in with an external camera or fingerprint reader for what you want. (see screenshot below)
4 Click/tap on Restart Now to immediately restart the computer to apply. (see screenshot below)
Be sure to save and close anything you want first.
1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.
2 Enable Enhanced Sign-in Security
This is the default setting.
A) Click/tap on the Download button below to download the REG file below, and go to step 4 below.
Enable_Enhanced_Sign-in_Security.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinBio]
"SupportPeripheralsWithEnhancedSignInSecurity"=dword:000000003 Disable Enhanced Sign-in Security
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Disable_Enhanced_Sign-in_Security.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinBio]
"SupportPeripheralsWithEnhancedSignInSecurity"=dword:000000014 Save the .reg file to your desktop.
5 If you have Smart App Control turned on, you will need to unblock the downloaded REG file.
6 Double click/tap on the downloaded .reg file to merge it.
7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
8 Restart the computer to apply.
9 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Last edited:
