Windows Biometrics Policy Registry Key Location

This article provides a direct overview of the Windows Registry key responsible for storing the configuration parameters of the Windows Biometric Framework (WBF) policies. It outlines the specific path located in the Registry Editor (regedit), explains the essential subkeys, and describes the primary values used to manage biometric login and device functionality across a Windows system.

Primary Registry Path

The configuration parameters for the Windows Biometric Framework Group Policies are stored under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics

If Group Policies for biometrics have not been configured yet on the system, this key or its subkeys may need to be created manually.

Key Subkeys and Configuration Values

Within the Biometrics key, several values and subkeys control how biometric hardware operates:

1. Global Biometrics Enablement

• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics
• Value Name: Enabled
• Type: REG_DWORD
• Data:
  • 1 = Biometrics are enabled system-wide.
  • 0 = Biometrics are disabled, preventing all applications and services from accessing biometric hardware.

2. Biometric Credential Provider (Logon Support)

To control whether users can use biometric authentication (such as fingerprint readers or facial recognition) to log on to Windows or elevate UAC prompts, the Credential Provider subkey is used:

• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider
• Value Name: Enabled
• Type: REG_DWORD
• Data:
  • 1 = Users can log on to Windows using biometric credentials.
  • 0 = Biometric logon is blocked.

3. Domain Account Support

To specifically permit or restrict domain users from logging on with biometric devices:

• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider
• Value Name: DomainAccounts
• Type: REG_DWORD
• Data:
  • 1 = Domain users are allowed to use biometrics to log on.
  • 0 = Domain users cannot use biometrics to log on.

4. Facial Recognition (Windows Hello Face)

For enhanced anti-spoofing and advanced facial recognition settings:

• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Facial Features
• Value Name: EnhancedAntiSpoofing
• Type: REG_DWORD
• Data:
  • 1 = Enhanced anti-spoofing is required (if hardware supports it).
  • 0 = Standard facial recognition is allowed.