Comments on: Configure FIDO security keys as the default sign-in option for Windows

By: Eugene

Eugene — Wed, 25 Sep 2024 14:56:24 +0000

guided me well but found that windows 11 turned round and said shows smart card requires drivers that are not present on this system W11 – I got in touch with the key provider and they led me down the line of reg key

REG ADD “HKLM\SOFTWARE\policies\Microsoft\FIDO” /v EnableFIDODeviceLogon /t REG_DWORD /d 1 /f

for some reason despite me putting the FIDO as credential providor it didn’t like the fido 2.1 nfc card in the reader, once I used that reg key it worked fine but still showed smartcard as an option instead. I’m sure it’s so simple if look deeper into it but up and running at the moment. So just providing reg key for those having similar issue.

By: Peter Klapwijk

Peter Klapwijk — Tue, 04 Jun 2024 12:57:39 +0000

In reply to Richard.

Hi Richard,

What is described in this article is only related to the sign-in options you have on the logon screen. You can still authenticate inside Windows itself with a password.
That’s different if you take the next step in going passwordless as you can read in this article https://inthecloud247.com/the-next-step-in-a-passwordless-windows-experience/

By: Richard

Richard — Mon, 03 Jun 2024 15:34:58 +0000

Hi Peter,
first of all thanks for this tutorial. Question from our side would be, if it is still possible to use Password Authentication for UAC prompts and Admin Login.
We would like to have our users forced to use the FIDO 2 Stick, in our case YubiKey 5, but the UAC prompt would still need a password and it must be possible to login as Admin using a password.

Looking forward for your thoughts 🙂

By: Peter Klapwijk

Peter Klapwijk — Fri, 05 Apr 2024 09:01:34 +0000

In reply to Mike B. Hi Mike, You are asked for a PIN because you are not using a BIO version key with a fingerprint. If you would have such a version, you're not asked for a PIN.

By: Mike B

Mike B — Thu, 04 Apr 2024 16:25:44 +0000

Thanks for this article Peter! I’ve just tried to set this up using a FIDO2 key and am asked to set up and then use a PIN with the key.

So at the Win login screen with the USB inserted it asks first for a PIN and then to touch the security key (might as well just use Win Hello PIN with this workflow).
Have MS changed this requirement since you published this article?

I want to be able to log in to windows by just touching the security key as in your article. I’m using a Thetis key which is U2F & FIDO2 (but doesn’t have a fingerprint reader like your key).

By: Koen Stronkhorst

Koen Stronkhorst — Thu, 30 Mar 2023 11:27:30 +0000

Hi Peter, one last question. When WHfB is forced, it seems that after adding and deploying this policy, the setup PIN (set up by WHfB) is still usable for login. Do you know if it’s required to turn off this WHfB, so that PIN code is no longer usable?

Or am I using the wrong GUID of the PIN credential provider? If yes, do you know which one I should use?

Thanks, again!

By: Peter Klapwijk

Peter Klapwijk — Mon, 06 Mar 2023 08:54:41 +0000

In reply to jeet. To setup WHfB, you still first have to sign in to the device with a password, that's where the FIDO key comes in. And on shared Windows devices sign in with a sec key is preferred above sign in with a password.

By: jeet

jeet — Sat, 04 Mar 2023 11:40:10 +0000

windows hello for business and FIDO both are phishing resistant have similar security.
just thinking why any org will invest in FIDO if they have WHFB.

By: Peter Klapwijk

Peter Klapwijk — Sat, 04 Mar 2023 08:27:08 +0000

In reply to Koen Stronkhorst. Just a comma, no other spaces.

By: Koen Stronkhorst

Koen Stronkhorst — Fri, 03 Mar 2023 07:28:52 +0000

In reply to Peter Klapwijk. Just one more questions Peter, when adding multiple credential providers, and separating them with a comma, do I have to use space after the comma or only comma and then next provider tag? Thanks!