Windows Registry Settings for Facial Recognition Logon

Windows allows administrators to control biometric sign-in options, including Windows Hello Face, through specific keys in the Windows Registry. This article explains the exact registry values in Regedit that enable or disable facial recognition on the Windows lock screen and provides the steps to configure them.

Primary Biometric Logon Policy Key

The central registry setting controlling whether biometric authentication (including facial recognition) is permitted for signing in at the lock screen is located in the Biometrics policy branch.

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider
• Value Name: Enabled
• Value Type: REG_DWORD
• Value Data:
  • 1 = Allows users to log on to the lock screen using biometrics (including facial recognition).
  • 0 = Blocks users from logging on to the lock screen using biometrics.

If the Credential Provider key does not exist under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics, you must create it manually.

Facial Recognition Specific Policy Key

To manage facial recognition specifically, Windows provides a dedicated FacialFeatures registry subkey:

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures
• Value Name: ConfigureFacialRecognition
• Value Type: REG_DWORD
• Value Data:
  • 1 = Windows Hello Face recognition is enabled.
  • 0 = Windows Hello Face recognition is disabled.

Additionally, to enforce or disable enhanced anti-spoofing for facial recognition: * Value Name: EnhancedAntiSpoofing * Value Type: REG_DWORD * Value Data: 1 (Enabled) or 0 (Disabled).

How to Configure the Setting via Regedit

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics

3. If the subkey Credential Provider or FacialFeatures is missing, right-click Biometrics, select New > Key, and name it accordingly.

4. Select the key, right-click the empty space in the right pane, and choose New > DWORD (32-bit) Value.

5. Name the value Enabled (for Credential Provider) or ConfigureFacialRecognition (for FacialFeatures).

6. Double-click the newly created value and set the Value data to 1 to allow facial recognition or 0 to prohibit it.

7. Click OK and restart your computer for the policy changes to take effect on the lock screen.