[2004, 20h2] Windows Hello vs. HP Spectre x360 (2017)

[Gongalong]

Hi folks,

 

I've rebuilt a Spectre we have here with 20H2. Subsequently I cannot get face sign-in to enable for domain accounts. It works fine for local accounts.

 

Under "Windows Hello Face" it says "This option is currently unavailable". If I click on that it says "Something went wrong. Try again later." The Set up button is greyed out.

 

With previous Win 10 builds the resolution was to enable the following in group policy: Administrative Templates > System > Login > Turn on convenience PIN sign-in

 

This hasn't worked this time though.

 

I've tried enabling a bunch more settings, although all of these are "On" when set to "Not Cofigured" (Windows Components > Biometrcics > Allow domains users to log on using biometrics, Allow the use of biometrics, Allow users to log on using biometrics. Also Windows Components > Windows Hello for Business).

 

I've checked for driver updates to the camera and the biometric driver, there aren't any (and the drivers are relatively recent).

 

Any ideas?

 

Thanks

[DJ-1701]

If you are using Microsoft 365 and have AD Connect with Hybrid Azure AD joined devices, this should work as it did for me...

 

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki

[Gongalong]

The machine is joined to a local domain, and the issue must be connected to that because the local admin account is fine. Previously the PIN setting solved it, so not sure what's changed. Sigh.