Windows Hello for Business

Good day to you. I'll try to explain what Windows Hello for Business is and how to set it up.

Windows Hello is an authentication system in Windows 10 based on a PIN, biometrics or a picture password. The for Business suffix means that all of this will work in a domain.

Why are passwords no longer good enough? Because! Seriously though, you can read about it here.

What do we need?

• Active Directory - at least 1 domain controller running Windows Server 2016. The domain functional level must be Windows Server 2012 R2 or higher.
• Public Key Infrastructure
• Azure Active Directory.
• Windows 10 as the client.

Configuring domain controller certificates

Clients must trust the domain controllers, and the best way to ensure that is to give each domain controller a Kerberos Authentication certificate. Installing a certificate on a domain controller lets the Key Distribution Center (KDC) prove its identity to other members of the domain.

Sign in to the certification authority or a management workstation with Domain Admin equivalent credentials.

1. Open the Certification Authority management console.
2. Right-click Certificate Templates and then click Manage.
3. In the Certificate Template Console, right-click the Kerberos Authentication template in the details pane and then click Duplicate Template.
4. On the Compatibility tab, clear the Show resulting changes check box. Select Windows Server 2012 or Windows Server 2012 R2 from the Certification Authority list. Select Windows Server 2012 or Windows Server 2012 R2 from the Certificate Recipient list.
5. On the General tab, type Domain Controller Authentication (Kerberos) in the Template display name box. Adjust the validity and renewal period to meet your organization's needs. Note: if you use different template names, you'll need to remember them and substitute them in the different parts of the lab.
6. On the Subject Name tab, click the Build from this Active Directory information button if it is not already selected. Select None from the Subject name format list. Select DNS name from the Include this information in alternate subject list. Clear all other check boxes.
7. On the Cryptography tab, select Key Storage Provider from the Provider Category list. Select RSA from the Algorithm name list. Type 2048 in the Minimum key size text box. Select SHA256 from the Request hash list. Click OK.
8. Close the console.

Superseding the existing domain controller certificate

Many domain controllers may already have a domain controller certificate. Active Directory Certificate Services provides a default certificate template for domain controllers - the Domain Controller certificate template. Later releases included a new certificate template - the Domain Controller Authentication certificate template. These certificate templates were provided before the Kerberos specification was updated to state that Key Distribution Centers (KDCs) performing certificate authentication must include the KDC Authentication extension.

The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers, and it is the one you should deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows makes it easy to replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with new ones based on the Kerberos Authentication certificate template.

Sign in to the certification authority or a management workstation with Enterprise Admin equivalent credentials.

1. Open the Certification Authority management console.
2. Right-click Certificate Templates and then click Manage.
3. In the Certificate Templates Console, right-click the Domain Controller Authentication (Kerberos) template (or the name of the certificate template you created in the previous section) in the details pane and click Properties.
4. Click the Superseded Templates tab. Click Add.
5. In the Add Superseded Template dialog, select the Domain Controller certificate template and click OK. Click Add.
6. In the Add Superseded Template dialog, select the Domain Controller Authentication certificate template and click OK.
7. In the Add Superseded Template dialog, select the Kerberos Authentication certificate template and click OK.
8. Add any other enterprise certificate templates previously configured for domain controllers to the Superseded Templates tab.
9. Click OK and close the Certificate Templates console.

The certificate template is now configured to supersede all the certificate templates in the superseded templates list.

Publishing certificate templates to the certification authority

A certification authority can only issue certificates for the certificate templates published to that certification authority.

1. Open the Certification Authority management console.
2. Expand the parent node in the navigation pane.
3. Click Certificate Templates in the navigation pane.
4. Right-click the Certificate Templates node. Click New, and then click Certificate Template to Issue.
5. In the Enable Certificates Templates window, select the Domain Controller Authentication (Kerberos) template you created in the previous steps. Click OK to publish the selected certificate template to the certification authority.
6. If you published the Domain Controller Authentication (Kerberos) certificate template, you should unpublish the certificate templates you included in the superseded templates list.
   • To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certification Authority console and select Delete. Click Yes to confirm the operation.
7. Close the console.

Configuring domain controllers for automatic certificate enrollment

Domain controllers automatically request a certificate from the Domain Controller certificate template. However, a domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To keep domain controllers automatically enrolling and renewing certificates with awareness of newer certificate templates and superseded template configurations, create and configure a Group Policy object for automatic certificate enrollment and link it to the Domain Controllers OU.

1. Start the Group Policy Management Console (gpmc.msc).
2. In the navigation pane, expand the domain and select the Group Policy Object node.
3. Right-click Group Policy Object and select New.
4. Type Domain Controller Auto Certificate Enrollment in the name box and click OK.
5. Right-click the Domain Controller Auto Certificate Enrollment Group Policy object and click Edit.
6. In the navigation pane, expand Policies under Computer Configuration.
7. Expand Windows Settings, Security Settings and click Public Key Policies.
8. In the details pane, right-click Certificate Services Client - Auto-Enrollment and select Properties.
9. Select Enabled from the Configuration Model list.
10. Select the Renew expired certificates, update pending certificates, and remove revoked certificates check box.
11. Select the Update certificates that use certificate templates check box.
12. Click OK. Close the Group Policy Management Editor.
13. In the navigation pane, expand the domain and the node whose name matches your Active Directory domain name. Right-click the Domain Controllers organizational unit and click Link an existing GPO...
14. In the Select GPO dialog box, select Domain Controller Auto Certificate Enrollment or the name of the domain controller certificate enrollment Group Policy object you created earlier and click OK.

The "Enable Windows Hello for Business" Group Policy

Windows needs the "Enable Windows Hello for Business" Group Policy setting to determine whether a user should attempt to enroll in Windows Hello for Business. A user will only attempt to enroll if this policy setting is enabled.

Creating the Windows Hello for Business Group Policy object

The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure that Windows Hello for Business authentication certificates are renewed automatically.

1. Start the Group Policy Management Console (gpmc.msc).
2. In the navigation pane, expand the domain and select the Group Policy Object node.
3. Right-click Group Policy Object and select New.
4. Type Enable Windows Hello for Business in the name box and click OK.
5. In the content pane, right-click the Enable Windows Hello for Business Group Policy object and click Edit.
6. In the navigation pane, expand Policies under User Configuration.
7. Expand Administrative Templates, Windows Component and select Windows Hello for Business.
8. In the content pane, double-click Use Windows Hello for Business. Click Enable and click OK.
9. Close the Group Policy Management Editor.

Configuring security in the Windows Hello for Business Group Policy object

The best way to deploy the Windows Hello for Business Group Policy object is to use security group filtering. This makes it easy to manage which users should get Windows Hello for Business simply by adding them to a group. It also lets you roll out Windows Hello for Business in phases.

1. Start the Group Policy Management Console (gpmc.msc).
2. In the navigation pane, expand the domain and select the Group Policy Object node.
3. Double-click the Enable Windows Hello for Business Group Policy object.
4. In the Security Filtering section of the content pane, click Add. Type Windows Hello for Business Users or the name of the security group you created earlier and click OK.
5. Click the Delegation tab, select Authenticated Users and click Advanced.
6. In the Group or User names list, select Authenticated Users. In the Permissions for Authenticated Users list, clear the Allow check box for the Apply group policy permission. Click OK.

Deploying the Windows Hello for Business Group Policy object

Applying the Windows Hello for Business Group Policy object uses security group filtering. This lets you link the Group Policy object at the domain level, ensuring it is within scope for all users. Security group filtering, however, ensures that only the users in the Windows Hello for Business Users global group receive and apply the Group Policy object, which results in Windows Hello for Business provisioning.

1. Start the Group Policy Management Console (gpmc.msc).
2. In the navigation pane, expand the domain, right-click the node with your Active Directory domain name and click Link an existing GPO...
3. In the Select GPO dialog box, select Enable Windows Hello for Business or the name of the Windows Hello for Business Group Policy object you created earlier and click OK.

Azure Active Directory

Now it's important to update the schema synchronized from Active Directory to Azure Active Directory. If you skip this, users entering their PIN will see an error saying that the (PIN sign-in) feature is temporarily unavailable.

Windows 10

You can now go ahead and set up a PIN, fingerprints and so on.