windows-itpro-docs/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md

title, description, ms.date, appliesto, ms.topic

title	description	ms.date	appliesto	ms.topic
Validate Active Directory prerequisites in an on-premises certificate trust	Validate Active Directory prerequisites when deploying Windows Hello for Business in a certificate trust model.	12/12/2022	✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a> ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>	tutorial

Validate Active Directory prerequisites - on-premises certificate trust

[!INCLUDE hello-on-premises-cert-trust]

The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema.

Create the Windows Hello for Business Users security group

The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business.

Sign-in to a domain controller or to a management workstation with a Domain Administrator equivalent credentials.

1. Open Active Directory Users and Computers
2. Select View > Advanced Features
3. Expand the domain node from the navigation pane
4. Right-click the Users container. Select New > Group
5. Type Windows Hello for Business Users in the Group Name
6. Select OK

[!div class="nextstepaction"] Next: validate and configure PKI >