mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-07 01:57:21 +00:00
- Updated Microsoft PIN reset configuration
- Changed privileged credential to dual enrollment - Added PAW up-sell in an important tag to dual enrollment
This commit is contained in:
Mike Stephens
parent
e895240406
commit
17eb260528
@ -10,7 +10,7 @@ ms.pagetype: security, mobile
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
localizationpriority: high
|
||||
ms.date: 3/5/2018
|
||||
ms.date: 05/05/2018
|
||||
---
|
||||
# Windows Hello for Business Features
|
||||
|
||||
@ -22,7 +22,7 @@ Consider these additional features you can use after your organization deploys W
|
||||
* [Conditional access](#conditional-access)
|
||||
* [Dynamic lock](#dynamic-lock)
|
||||
* [PIN reset](#pin-reset)
|
||||
* [Privileged credentials](#privileged-credentials)
|
||||
* [Dual Enrollment](#dual-enrollment)
|
||||
|
||||
|
||||
## Conditional access
|
||||
@ -40,7 +40,6 @@ To improve productivity, Azure Active Directory provides your users with a broad
|
||||
|
||||
Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access.
|
||||
|
||||
|
||||
## Dynamic lock
|
||||
|
||||
**Requirements:**
|
||||
@ -81,41 +80,62 @@ RSSI measurements are relative and lower as the bluetooth signals between the tw
|
||||
|
||||
## PIN reset
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10, version 1709 or later
|
||||
|
||||
|
||||
### Hybrid Deployments
|
||||
|
||||
**Requirements:**
|
||||
* Azure Active Directory
|
||||
* Hybrid Windows Hello for Business deployment
|
||||
* Modern Management - Microsoft Intune, or compatible mobile device management (MDM)
|
||||
* Remote reset - Windows 10, version 1703
|
||||
* Reset above Lock - Windows 10, version 1709
|
||||
* Azure AD registered, Azure AD joined, and Hybrid Azure AD joined
|
||||
|
||||
|
||||
The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables you to remotely push a PIN reset or enables users to reset their forgotten PIN above the lock screen without requiring reenrollment.
|
||||
The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment.
|
||||
|
||||
#### Onboarding the Microsoft PIN reset service to your Intune tenant
|
||||
|
||||
Before you can remotely reset PINs, you must onboard the Microsoft PIN reset service to your Intune or MDM tenant, and configure devices you manage. Follow these instructions to get that set up:
|
||||
Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage.
|
||||
|
||||
#### Connect Intune with the PIN reset service
|
||||
#### Connect Azure Active Directory with the PIN reset service
|
||||
|
||||
1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Intune tenant.
|
||||
1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant.
|
||||
2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.<br>
|
||||
<br>
|
||||
3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications**, **All applications** blade.<br>
|
||||
|
||||
3. In the Azure portal, you can verify that Intune and the PIN reset service were integrated from the Enterprise applications - All applications blade as shown in the following screenshot:<br>
|
||||
|
||||
4. Log in to [this website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent) using your Intune tenant admin credentials and, again, choose **Accept** to give consent for the service to access your account.
|
||||
|
||||
#### Configure Windows devices to use PIN reset
|
||||
#### Configure Windows devices to use PIN reset using Group Policy
|
||||
You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object.
|
||||
|
||||
1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory.
|
||||
2. Edit the Group Policy object from step 1.
|
||||
3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**.
|
||||
4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC.
|
||||
|
||||
#### Configure Windows devices to use PIN reset using Microsoft Intune
|
||||
To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/en-us/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP):
|
||||
|
||||
- **For devices** - **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery**
|
||||
##### Create a PIN Reset Device configuration profile using Microsoft Intune
|
||||
|
||||
*tenant ID* refers to your Azure Active Directory, Directory ID which you can obtain from the **Properties** page of Azure Active Directory.
|
||||
|
||||
Set the value for this CSP to **True**.
|
||||
|
||||
Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/device-windows-pin-reset#steps-to-reset-the-passcode) section to remotely reset a PIN on an Intune managed device.
|
||||
1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account.
|
||||
2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
|
||||
```
|
||||
dsregcmd /status | findstr -snip "tenantid"
|
||||
```
|
||||
3. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**.
|
||||
4. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list.
|
||||
5. In the **Custom OMA-URI Settings** blade, Click **Add**.
|
||||
6. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where <b>*tenant ID*</b> is your Azure Active Directory tenant ID from step 2.
|
||||
7. Select **Boolean** from the **Data type** list and select **True** from the **Value** list.
|
||||
8. Click **OK** to save the row configuration. Click **OK** to close the **Custom OMA-URI Settings blade. Click **Create** to save the profile.
|
||||
|
||||
##### Assign the PIN Reset Device configuration profile using Microsoft Intune
|
||||
1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account.
|
||||
2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration.
|
||||
3. In the device configuration profile, click **Assignments**.
|
||||
4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups.
|
||||
|
||||
### On-premises Deployments
|
||||
|
||||
@ -125,10 +145,10 @@ Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/d
|
||||
* Reset from settings - Windows 10, version 1703
|
||||
* Reset above Lock - Windows 10, version 1709
|
||||
|
||||
On-premises deployments provide users with the ability to reset forgotton PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then reprovision Windows Hello for Business.
|
||||
On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Users must have corporate network connectivity to domain controllers and the AD FS server to reset their PINs.
|
||||
>Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs.
|
||||
|
||||
#### Reset PIN from Settings
|
||||
1. Sign-in to Windows 10, version 1703 or later using an alternate credential.
|
||||
@ -139,20 +159,34 @@ On-premises deployments provide users with the ability to reset forgotton PINs e
|
||||
1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in
|
||||
2. Enter your password and press enter.
|
||||
3. Follow the instructions provided by the provisioning process
|
||||
4. When finished, unlock your desktop using your newly creeated PIN.
|
||||
4. When finished, unlock your desktop using your newly created PIN.
|
||||
|
||||
>[!NOTE]
|
||||
> Visit the [Frequently Asked Questions](https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-identity-verification#frequently-asked-questions) section of the Windows Hello for Business page and watch the **What happens when the user forgets their PIN?** video.
|
||||
|
||||
## Privileged Credentials
|
||||
## Dual Enrollment
|
||||
|
||||
**Requirements**
|
||||
* Hybrid and On-premises Windows Hello for Business deployments
|
||||
* Domain Joined or Hybrid Azure joined devices
|
||||
* Windows 10, version 1709
|
||||
|
||||
The privileged credentials scenario enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device.
|
||||
> [!IMPORTANT]
|
||||
> Dual enrollment not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Busines dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information.
|
||||
|
||||
By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, Allow enumeration of emulated smart card for all users, you can configure a device to all this enumeration on selected devices.
|
||||
Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device.
|
||||
|
||||
With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal workflow such as email, but can launch Microsoft Managment Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternativing between privileged and non-privileged workloads.
|
||||
By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices.
|
||||
|
||||
With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privleged or non-privleged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation.
|
||||
|
||||
### Configuring Dual Enrollment using Group Policy
|
||||
You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object.
|
||||
|
||||
1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to Active Directory computer accounts used by privileged users.
|
||||
2. Edit the Group Policy object from step 1.
|
||||
3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**.
|
||||
4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC.
|
||||
Loading…
x
Reference in New Issue
Block a user