Windows Hello Face Recog setup fails to complete

[xaanda]

Hi - has anyone encountered a problem with setting up face recognition for Windows Hello where the setup process fails to complete?

Accounts --> Sign-in Options --> Windows Hello --> Setup

The setup screen appears, PIN is accepted, I get the camera view with "Make sure your face is centred in the frame." message but nothing happens beyond that - no progress bar; I'm just sat there looking at myself!

Surface Book i7 / 16GB / 512 GB - up-to-date as at today (14/6/16)
Have tried under both domain login (is a work device) and with local account - I do get the "Some settings are managed by your organisation" banner on the Accounts screen but obviously the face Setup button is still enabled
Have tried varying lighting conditions and distance to camera etc

Does the feature only work with Microsoft accounts? If so, shouldn't there be a prompt to log in with MS account first or have I missed something else ?
Thanks

 

[leeshor]

It should work in almost any lighting condition, with either a local or a Microsoft account. However, the domain policies, even with a local account, could get in the way. Those policies would not necessarily generate an error/banner.

Maybe someone else can chime in here.

 

[jnjroach]

If it is a Domain Account, is it authenticating against local AD or Azure AD? Also, you need to configure a PIN to use "Hello", if policy prevents PIN setup Hello won't be available.

 

[xaanda]

If it is a Domain Account, is it authenticating against local AD or Azure AD? Also, you need to configure a PIN to use "Hello", if policy prevents PIN setup Hello won't be available.

Hi Jeff
- the domain authentication is against a local AD.
- yes, PIN set-up has been performed - it's not possible to get to the step I'm stuck on until a PIN has been created.

 

[jnjroach]

From an elevated CMD Prompt you can see if GPO/Security Policies are preventing it - c:\windows\system32>gpresult /z >c:\GPOResults.txt

 

[xaanda]

From an elevated CMD Prompt you can see if GPO/Security Policies are preventing it - c:\windows\system32>gpresult /z >c:\GPOResults.txt

Hi Jeff - thanks for that - what section of the results file/search phrase should I be looking in?

 

[jnjroach]

Hi Jeff - thanks for that - what section of the results file/search phrase should I be looking in?

Look for:

credentialproviders.admx

 

[xaanda]

Look for:

credentialproviders.admx

Hi Jeff - I can't see any entries in the file with that descriptor (I can't see any .admx entries at all).

 

[jnjroach]

Hi Jeff - I can't see any entries in the file with that descriptor (I can't see any .admx entries at all).

Sorry, the section would be labeled "CredentialProvider" if it isn't listed you're org hasn't imported Windows 10 compatible GPO settings.

 

[xaanda]

Sorry, the section would be labeled "CredentialProvider" if it isn't listed you're org hasn't imported Windows 10 compatible GPO settings.

Hi Jeff - no section labelled CredentialProvider in the output file. Are you implying that the admins need to add some additional (Windows 10-specific) GPO settings for the domain controller?

**UPDATED** Ok - just found the link New policies for Windows 10 (Windows 10)
I'll have a chat to the admins about adding these. I may also try resetting the Surface Book if I get bored this weekend. If I do, I'll test out Hello before I re-add it to the domain. Will let you know what I find...

 

[jnjroach]

Let us know

 

[xaanda]

Ok - I reset the tablet on the weekend & created a local account only; Hello setup completes normally and works as described. When I add to the work domain and try to set up Hello for the domain login, setup fails as described above: presumably from this it's a domain policy problem -looks like I need to do some more reading up on windows 10 policies on an sbs server...