Windows 10 Hello on domain-joined computer - Credentials could not be verified

Question

I am on a Lenovo X1 6th Gen laptop with Windows 10 Pro Build 1803 and connecting to my work domain. I have all GPO's correctly configured for Windows Hello. I am able to login to my domain account using password and it prompts me to set up facial recognition and pin. I get through it successfully. When I go to login, I have options for facial recognition and pin. However, if I try logging in with either of these options, it tells me the Credentials could not be verified.

I have configured all Windows Hello GPO's according to these two links:

Can't enable Windows Hello - Some settings are managed by your organization

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings

I tried unjoining domain, deleting the computer object in AD, and rejoining the domain. Tried rebooting. Tried resetting facial recognition. I've tried everything I could but still, it says my credentials could not be verified when using facial recognition or pin login. The password login still works fine.

What am I doing wrong? How can it be so difficult to set this up?

Here is the settings screen:

Solution

My solution ultimately was to delete the NGC folder here: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC

That cleared out the previous biometrics data attached to my user profile and allowed me to configure it all from scratch and it works great now!

All credit goes to /u/mrbeezkneez who posted the solution here: https://www.reddit.com/r/sysadmin/comments/7xm2d3/fingerprint_scanner_with_windows_10_on_domain/dub20ei/

Comments

[Ramhound]

Have you contacted your AD Administrator for assistance?

[blizz]

@Ramhound yes, it's me :)

[Ramhound]

If you disconnect the machine from the domain, create a local account then enable Windows Hello, does it work? Likewise, if you try a test profile, does it work? This indicates it might be a hardware compatibility issue. Are you sure you have a Windows Hello compatible camera, there are very specific requirements, for facial recognition to work.

[Ravindra Bawane]

Are you using Hello for Business, of Windows 10 Hello?

[blizz]

@Ramhound yes it works fine from my local account

[blizz]

@music2myear I'm just trying to enroll to Windows Hello that's available on my laptop in the settings...I added a screenshot of the settings screen