Prevent Domain Biometric Logon via Regedit

This guide outlines how to prevent users from using Windows Hello biometric authentication—such as facial recognition or fingerprint scanning—to log into enterprise domain accounts. By configuring specific policy values within the Windows Registry Editor (regedit), administrators can enforce traditional password or smart card authentication methods across domain-joined machines without entirely disabling local biometric capabilities.

Registry Configuration Steps

To disable biometric logons for enterprise domain accounts, modify the system registry using the steps below:

1. Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter.
  3. Select Yes if prompted by User Account Control (UAC) to run with administrative privileges.

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider

Note: If the Biometrics or Credential Provider subkeys do not exist, right-click on the parent folder, select New > Key, and name the key accordingly.

3. Create or Modify the DomainLogon DWORD Value

  1. Right-click on the Credential Provider key in the left pane or the empty space in the right pane.
  2. Select New > DWORD (32-bit) Value.
  3. Name the new value: DomainLogon
  4. Double-click DomainLogon to modify its properties.
  5. Set the Value data field to 0.
  6. Ensure the Base is set to Hexadecimal (or Decimal, as 0 is the same in both).
  7. Click OK.

4. Apply Changes

  1. Close the Registry Editor.
  2. Restart the computer or restart the Windows Biometric Service via services.msc for the policy to take effect immediately.

Fast Configuration via Command Prompt (Alternative)

To apply this registry setting quickly across managed machines without manually navigating the Registry Editor, run the following command in an elevated Command Prompt:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider" /v DomainLogon /t REG_DWORD /d 0 /f

How It Works