Windows 11

Change Power Plan from CMD

C:\>powercfg /s SCHEME_MIN
C:\>powercfg /getactivescheme
Power Scheme GUID: 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c  (High performance)
C:\>powercfg /s 381b4222-f694-41f0-9685-ff5bb260df2e
C:\>powercfg /getactivescheme
Power Scheme GUID: 381b4222-f694-41f0-9685-ff5bb260df2e  (Balanced)
C:\>powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
Power Scheme GUID: 37b19763-c6d1-40db-836b-ded7a4eaa53e  (Ultimate Performance)
C:\>powercfg /s 37b19763-c6d1-40db-836b-ded7a4eaa53e

STEP 1: Verify Local Biometrics Isn’t Disabled

Open gpedit.msc and check:

Computer Configuration → Administrative Templates → Windows Components → Biometrics

Make sure these are set to Enabled:

• ✔ Allow the use of biometrics
• ✔ Allow users to log on using biometrics
• ✔ Allow domain users to log on using biometrics

If they are Not Configured, flip them to Enabled.

Reboot.

STEP 2: Enable Windows Hello for Business (WHfB) in Domain Policy

Windows 11 no longer treats face recognition as a simple biometric — it is bound to Windows Hello for Business logic when domain accounts are involved.

In gpedit.msc:

Computer Configuration → Administrative Templates → Windows Components → Windows Hello for Business

Enable:

• ✔ Use Windows Hello for Business
• ✔ Configure Windows Hello for Business = Enabled

Use recommended defaults or "Enabled, Not Configured" for the sub-settings.

Reboot again.

STEP 3: Registry Check (Sometimes GPO Doesn’t Apply on Non-Azure AD Domains)

Open PowerShell as Administrator and run:

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Name "Enabled" -Value 1 -Type DWord

Then:

gpupdate /force

STEP 4: If Biometrics service is broken, re-register it

Run (Admin PowerShell):

Get-Service WbioSrvc | Set-Service -StartupType Automatic Start-Service WbioSrvc

STEP 5: Remove Credential Provider Restrictions (if applied)

Sometimes Synology AD or manual hardening blocks Hello login.

Check registry:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers /s

Look for strange Disabled or excluded entries affecting biometric GUIDs. If you want me to interpret the output, paste it here.

STEP 6: Check if Windows Hello Camera Driver Was Disabled After Domain Join

Open Device Manager → Biometric Devices → Windows Hello Face Authentication.

If disabled, re-enable it.

If missing, reinstall via:

pnputil /scan-devices

Or under “Optional updates” in Windows Update.

Alt + Numeric keypad symbols

• Alt + 0169  ©  Copyright
• Alt + 0151  —  Emdash