mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
updating PIN complexity MDM settings
This commit is contained in:
mapalko
@ -15,13 +15,12 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/18/2017
|
||||
ms.date: 4/16/2017
|
||||
---
|
||||
|
||||
# Manage Windows Hello for Business in your organization
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10.
|
||||
@ -35,7 +34,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will
|
||||
|
||||
## Group Policy settings for Windows Hello for Business
|
||||
|
||||
The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
|
||||
The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**.
|
||||
@ -43,13 +42,15 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2">Policy</th>
|
||||
<th>Scope</th>
|
||||
<th>Options</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use Windows Hello for Business</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users can provision Windows Hello for Business, which encrypts their domain password.</p>
|
||||
<p><b>Not configured</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
<p><b>Enabled</b>: Device provisions Windows Hello for Business using keys or certificates for all users.</p>
|
||||
<p><b>Disabled</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
</td>
|
||||
@ -57,15 +58,37 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
<tr>
|
||||
<td>Use a hardware security device</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use certificate for on-premises authentication</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<td>Use PIN recovery</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p><b>Not configured</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use biometrics</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
<p><b>Enabled</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
@ -75,6 +98,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
<tr>
|
||||
<td rowspan="8">PIN Complexity</td>
|
||||
<td>Require digits</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users must include a digit in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include a digit in their PIN.</p>
|
||||
@ -83,6 +107,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require lowercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot use lowercase letters in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one lowercase letter in their PIN.</p>
|
||||
@ -91,6 +116,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Maximum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be less than or equal to 127.</p>
|
||||
<p><b>Enabled</b>: PIN length must be less than or equal to the number you specify.</p>
|
||||
@ -99,6 +125,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Minimum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be greater than or equal to 4.</p>
|
||||
<p><b>Enabled</b>: PIN length must be greater than or equal to the number you specify.</p>
|
||||
@ -107,6 +134,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Expiration</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN does not expire.</p>
|
||||
<p><b>Enabled</b>: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.</p>
|
||||
@ -115,6 +143,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>History</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Previous PINs are not stored.</p>
|
||||
<p><b>Enabled</b>: Specify the number of previous PINs that can be associated to a user account that can't be reused.</p>
|
||||
@ -125,6 +154,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require special characters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include a special character in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one special character in their PIN.</p>
|
||||
@ -133,6 +163,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require uppercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include an uppercase letter in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one uppercase letter in their PIN.</p>
|
||||
@ -140,9 +171,9 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>>Phone Sign-in</td>
|
||||
<td>
|
||||
<p>Use Phone Sign-in</p>
|
||||
<td>Phone Sign-in</td>
|
||||
<td>Use Phone Sign-in</td>
|
||||
<td>Computer</td>
|
||||
</td>
|
||||
<td>
|
||||
<p>Not currently supported.</p>
|
||||
@ -167,7 +198,7 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<tr>
|
||||
<td>UsePassportForWork</td>
|
||||
<td></td>
|
||||
<td>Device</td>
|
||||
<td>Device or user</td>
|
||||
<td>True</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will be provisioned for all users on the device.</p>
|
||||
@ -179,7 +210,7 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<tr>
|
||||
<td>RequireSecurityDevice</td>
|
||||
<td></td>
|
||||
<td>Device</td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will only be provisioned using TPM.</p>
|
||||
@ -187,6 +218,28 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Exclude Security Device</td>
|
||||
<td>TPM12</td>
|
||||
<td>Device</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.</p>
|
||||
<p>False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>EnablePinRecovery</td>
|
||||
<td></td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p>False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">Biometrics</td>
|
||||
<td>
|
||||
<p>UseBiometrics</p>
|
||||
@ -302,7 +355,43 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
</table>
|
||||
|
||||
>[!NOTE]
|
||||
> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.
|
||||
> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN.
|
||||
|
||||
## Policy conflicts from multiple policy sources
|
||||
|
||||
Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device.
|
||||
|
||||
Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source.
|
||||
|
||||
Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis.
|
||||
|
||||
>[!NOTE]
|
||||
> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP.
|
||||
|
||||
><b>Examples</b>
|
||||
>
|
||||
>The following are configured using computer Group Policy:
|
||||
>
|
||||
>- Use Windows Hello for Business - Enabled
|
||||
>- User certificate for on-premises authentication - Enabled
|
||||
>- Require digits - Enabled
|
||||
>- Minimum PIN length - 6
|
||||
>
|
||||
>The following are configured using device MDM Policy:
|
||||
>
|
||||
>- UsePassportForWork - Disabled
|
||||
>- UseCertificateForOnPremAuth - Disabled
|
||||
>- MinimumPINLength - 8
|
||||
>- Digits - 1
|
||||
>- LowercaseLetters - 1
|
||||
>- SpecialCharacters - 1
|
||||
>
|
||||
>Enforced policy set:
|
||||
>
|
||||
>- Use Windows Hello for Business - Enabled
|
||||
>- Use certificate for on-premises authentication - Enabled
|
||||
>- Require digits - Enabled
|
||||
>- Minimum PIN length - 6d
|
||||
|
||||
## How to use Windows Hello for Business with Azure Active Directory
|
||||
|
||||
|
||||
Reference in New Issue
Block a user