Windows 11: 22H2 · 1.0 to 23H2 · 1.0

Enhanced Sign-in Security [added: (ESS) ]isolates Windows Hello biometric (face and fingerprint) template data and matching operations to trusted hardware or specified memory regions, meaning the rest of the operating system cannot access or tamper with them. Because the channel of communication between the sensors and the algorithm is also secured, it is impossible for malware to inject or replay data in order to simulate a user signing in or to lock a user out of their machine.[removed: While this policy is enabled on Windows 11 devices, external biometric authentication with Windows Hello will be blocked. Any non-authentication operational functionalities such as camera usage will be unaffected. ][added: ]If you enable this policy then it can have following possible values: 0 - Enhanced Sign-in Security [removed: Disabled (not recommended)][added: Enabled with peripheral and built-in non-ESS sensors] Enhanced sign-in security will be [removed: dis][added: en]abled on [removed: all systems, enabling the use of external biometric authentication. If a user has enrolled ][added: systems with capable software and hardware, following the existing default behavior ]in [removed: Windows Hello with Enhanced Sign-in Security enabled, when the feature gets disabled, they will lose their enrollment and must reset PIN. At that point they ][added: Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS ]will [removed: have the option to re-enroll in biometrics. OS will not attempt to start secure components, even if the secure hardware ][added: be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR ]and [removed: software components are present.][added: a non-ESS capable camera.] 1 - Enhanced Sign-in Security Enabled [added: without peripheral or built-in non-ESS sensors ](default and recommended for highest security) Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any [added: peripheral ]biometric device [removed: that Enhanced Sign-in Security does not support, including that of peripheral devices, ]will be blocked and not available for Windows Hello. If you disable or not configure this policy then [removed: Enhanced Sign-in Security is preferred on the device. The behavior ][added: non-ESS sensors ]will be [removed: same as enabling ][added: blocked on ]the [removed: policy and setting value to 1.][added: ESS device.]