Windows Hello for Business Troubleshooting Guide - ToddMaxey/Technical-Documentation GitHub Wiki

This guide covers troubleshooting for Windows Hello for Business (WHfB) on Windows 10/11 and Windows Server 2016/2019/2022 across all deployment models (key trust, certificate trust, hybrid, cloud). Each section lists diagnostics and remediation steps, precisely annotated with numeric references to Microsoft documentation.

1. Verify WHfB policy settings. Ensure the Group Policy or Intune profile enabling WHfB is applied. In AD Group Policy (Computer or User → Windows Components → Windows Hello for Business), set Use Windows Hello for Business to Enabled [7]. For on-prem certificate trust, enable Use certificate for on-premises authentication [4]. Additionally, Enable biometrics and Enable convenience PIN sign-in should be Enabled if using fingerprint/face or PIN [7]. Use gpresult /H report.html or RSOP to confirm settings.

2. Check Intune configuration. In Microsoft Intune’s Windows Hello enrollment policy, ensure Windows Hello for Business is Enabled [5]. If Disabled, devices cannot provision WHfB. Verify Use a TPM setting; default is Required, mandating TPM 2.0 (set to Preferred if no TPM) [5]. Also configure PIN requirements consistently between Intune and GPO.

3. Validate device registration settings. WHfB hybrid/cloud requires device registration. Run dsregcmd /status for “AzureAdJoined” or “HybridAzureADJoined” state [8]. If not registered, rejoin with dsregcmd /leave then /join. Ensure Azure AD Connect syncs objects properly (see Section 5).

1. Check device hardware and drivers. In Device Manager, verify biometric devices have current drivers. Missing Windows Hello options in Settings > Sign-in options often indicate driver issues. Remove stored fingerprints, uninstall/reinstall the device and driver [10].

2. Camera or fingerprint failures. Confirm camera supports Windows Hello (IR/depth). In Settings > Privacy > Camera, allow access. Update camera driver/firmware. Check HelloForBusiness diagnostic logs via Event Viewer.

1. Verify TPM availability. WHfB requires TPM 2.0; open tpm.msc to verify. Enable TPM in BIOS/UEFI if disabled [6].

2. Initialize or reset TPM. If TPM initialization fails, use Clear TPM in tpm.msc. Ensure firmware compliance and remove non-Microsoft TPM drivers [11].

3. Device join and sync. For hybrid, verify Hybrid Azure AD Join status and Azure AD Connect sync. Use:

   Get-ADUser <user> -Properties msDS-KeyCredentialLink

   to confirm key credential syncing [2][3].

1. "Option temporarily unavailable" error. In hybrid key-trust deployments, check msDS-KeyCredentialLink before/after sign-in. Install WS2016/WS2019 updates to prevent key deletion [12][13].

2. Event log indicators. In Event Viewer:

   • Event ID 300: Successful provisioning [9].
   • Events 362/360: Check device authentication with AD FS [14].
   • Kerberos/Winlogon errors indicate certificate/clock issues.

3. Certificate-based errors. Ensure DC cert includes correct subject or SAN entries. Remove stale root CA certificates [1].

4. Windows Hello sign-in errors. Check connectivity issues. Common errors:

   • 0x80090005, 0x8009000F, 0x80090011: Unjoin/rejoin device [10].
   • 0x80090029: Prepare TPM via tpm.msc [10].
   • NTE_NO_MEMORY or NTE_AUTHENTICATION_IGNORED: Close apps or reboot [10].

1. Azure AD Connect and Hybrid Join. Ensure correct syncing and time synchronization. Check Azure AD Admin Center for Hybrid Join status [8].

2. Network and credentials. Verify stable connectivity. Clear outdated credentials from Credential Manager to resolve cached credential issues [8].

3. AD FS issues. Error 1021: add the ugs scope in AD FS management [14].

4. Certificate Trust Enrollment. Ensure WHfB certificate template is correctly published/enrolled. Verify certificates using certmgr.msc.

1. Conflicting policies. Use gpresult or Intune reports to find conflicting WHfB settings. Ensure consistency between GPO and Intune settings [7][5].

2. Intune profile conflicts. Align Intune account protection settings with WHfB profile [5].

3. Device scope and filtering. Confirm correct targeting of users/devices/groups with consistent security groups [4].

1. Check msDS-KeyCredentialLink. Use provided Microsoft scripts to verify correct provisioning:

   Import-Module ActiveDirectory
   Get-ADUser -Filter * -Properties msDS-KeyCredentialLink | ForEach-Object { ... }

   [2][3].

2. Certificate Trust enrollment. Verify enrollment via CA templates, AD FS logs, and User Device Registration logs.

3. KDC/DC certificates. Ensure valid DC authentication certificates from trusted CA [1].

4. Event log troubleshooting. Enable detailed logs (User Device Registration, HelloForBusiness, Kerberos operational logs).

5. Fallback provisioning steps. Remove and reconfigure PIN/biometrics in Settings > Sign-in options if persistent failures occur.

---

1. Windows Hello for Business known deployment issues https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-issues

2. Retrieve certificate to troubleshoot Windows Hello for Business logon failures https://learn.microsoft.com/en-us/troubleshoot/windows-client/user-profiles-and-logon/retrieve-certificate-to-troubleshoot-windows-hello-for-business

3. Scripts: View the certificate information in the msDS-KeyCredentialLink attribute https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/script-to-view-msds-keycredentiallink-attribute-value

4. Configure and enroll in Windows Hello for Business (on-premises certificate trust) https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust

5. Configure Windows Hello for Business on devices (Intune) https://learn.microsoft.com/en-us/intune/intune-service/protect/windows-hello

6. TPM needed for Windows Hello/Windows Hello for Business, or not https://learn.microsoft.com/en-us/answers/questions/452782/tpm-needed-for-windows-hello-windows-hello-for-bus

7. Windows Hello for Business policy settings (Group Policy) https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/policy-settings

8. Intermittent issue signing into Windows Hello For Business using Cloud Trust https://learn.microsoft.com/en-us/answers/questions/2029516/intermittent-issue-signing-into-windows-hello-for

9. Event ID 300 – Windows Hello successfully created https://learn.microsoft.com/en-us/previous-versions/troubleshoot/windows-client/event-id-300-windows-hello-successfully-created-in-windows-10

10. Windows Hello errors during PIN creation https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation

11. Troubleshoot the TPM https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm

12. December 8, 2020—KB4593226 (OS Build 14393.4104) for Windows Server 2016 https://support.microsoft.com/en-us/topic/december-8-2020-kb4593226-os-build-14393-4104-expired-240c858e-ae0a-a106-0b8f-a05845c9c4bf

13. December 8, 2020—KB4592440 (OS Build 17763.1637) for Windows Server 2019 https://support.microsoft.com/en-us/topic/december-8-2020-kb4592440-os-build-17763-1637-expired-9181daf2-e180-b711-162f-b0d1a8d38dd9

14. Troubleshoot Active Directory Federation Services with events and logging https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging