A housing agency in Tennessee wanted staff to be able to sign in with a PIN, fingerprint or face, without forcing anyone to change how they log in.
Environment: on-premises Active Directory with no Entra ID or Intune, so Group Policy was the right tool.
What I did: backed up every existing GPO, updated the central store with current Windows 11 administrative templates, and built one dedicated, reversible GPO for convenience PIN and biometrics with a 6-digit PIN minimum. A WMI filter limits it to workstations, so servers and the domain controller never apply it, and a pilot group let us test before the wider rollout.
Troubleshooting: during the pilot, PIN setup reported that the option was unavailable. The cause was "Use Windows Hello for Business" set to Disabled, which on Windows 11 also blocks the convenience PIN. Changing it to Not Configured fixed it.
Result: optional Windows Hello working on the pilot workstation with every test passed, plus step-by-step instructions staff can follow on their own.
0 likes · 0 views · Nov 6, 2026
Enabled optional PIN and biometric sign-in through one reversible Group Policy, limited to workstations. Fixed a Windows 11 PIN blocker in pilot.
