Windows 10 Hello on domain-joined computer - Credentials could not be verified

Question

I am on a Lenovo X1 6th Gen laptop with Windows 10 Pro Build 1803 and connecting to my work domain. I have all GPO's correctly configured for Windows Hello. I am able to login to my domain account using password and it prompts me to set up facial recognition and pin. I get through it successfully. When I go to login, I have options for facial recognition and pin. However, if I try logging in with either of these options, it tells me the Credentials could not be verified.

I have configured all Windows Hello GPO's according to these two links:

Can't enable Windows Hello - Some settings are managed by your organization

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings

I tried unjoining domain, deleting the computer object in AD, and rejoining the domain. Tried rebooting. Tried resetting facial recognition. I've tried everything I could but still, it says my credentials could not be verified when using facial recognition or pin login. The password login still works fine.

If I login to my local admin account, Windows Hello works fine and I am able to login with facial recognition and pin. Please note it's Windows Hello, not Hello for Business.

What am I doing wrong? How can it be so difficult to set this up?

Here is the settings screen:

Solution

My solution ultimately was to delete the NGC folder here: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC

That cleared out the previous biometrics data attached to my user profile and allowed me to configure it all from scratch and it works great now!

All credit goes to /u/mrbeezkneez who posted the solution here: https://www.reddit.com/r/sysadmin/comments/7xm2d3/fingerprint_scanner_with_windows_10_on_domain/dub20ei/