Library Pack Header

Windows Hello for Business (WHfB) significantly enhances security by replacing traditional passwords with strong, two-factor authentication methods, such as biometrics (fingerprint or facial recognition) and PINs. This approach reduces the risk of phishing attacks and credential theft, providing a more secure authentication process for business IT departments.\n\nBy providing a comprehensive dashboard to monitor and manage the deployment of Windows Hello for Business (WHfB) across your organization, you can gain a clear overview of devices where WHfB is activated and details of the authentication methods used.\n\nThis dashboard shows the distribution of authentication methods across devices and provides insights into the usage of passwords, PINs, and biometric methods, helping to identify trends and areas for improvement.\n\nTo promote the adoption of more secure authentication methods, the library pack features a user campaign that informs users about the benefits of using alternative sign-in methods and directs users to documentation on how to enable and use these methods.\n\nBy implementing this pack, you:\n\n* Enhance security by reducing the risk of phishing attacks and credential theft.\n* Simplify user authentication with faster and more convenient login methods.\n* Reduce IT workload by minimizing the need for password resets and management.\n* Increase productivity by streamlining the login process for users.

Windows Hello for business - Adoption

This Remote Action is designed for use with endpoints that are Entra ID joined (full Microsoft cloud attached scenarios) and should be executed from a Nexthink Flow.\n\nThe Remote Action is used within the Flow to calculate whether the employee password is due to expire (based on the input thresholds provided).\n\nYou should use the Flow API thinklet to get the password expiry date for the signed-in user. You should then pass the output of that Flow thinklet into this Remote Action, populating the input called 'last_password_change_date_time'. We then perform a calculation (in the Remote Action) which uses the Entra ID API thinklet supplied 'DateTime' of last password reset along with the inputs provided on this Remote Action, to determine if the output 'password_reset_reminder_trigger' should be set to True. \n\nIf the output is True in the above case, you can then trigger a campaign using that output in the Flow, to inform the user that their password expiry date is approaching.

This value should match the password reset policy value in days which is set in Entra ID. It must be provided to perform the calculation

Password reset threshold

The date and time that the password was last reset which is provided using the API widget contained in the Nexthink Flow

Last password change date time

This input value is the expiry countdown (number of days) at which you would like the user to begin being prompted to perform a password reset. When the threshold is active the user will be reminded on each Flow execution

Reminder threshold

Get password expiry for Entra ID endpoints

If the reminder threshold is active (the user password reset date is within the reminder value provided) then the value is set to 'true'

Password reset reminder trigger

Numerical value which shows the current number of days until password expiry for the person using the device

Number of days until password expiry

This Remote Action assesses a device's readiness and adoption of Windows Hello by performing a series of hardware and usage checks. It verifies:\n\n1) Hardware readiness for Facial Recognition and Fingerprint Sensor (Ready / Not Ready)\n\n2) User enrollment status in Windows Hello (Enrolled / Not Enrolled)\n\n3) Last sign-in method used (Facial Recognition / Fingerprint / PIN / Password)\n\n4) Timestamp of the last sign-in\n\nSome environments may have different custom GUIDs for detecting password-based sign-ins. To handle this variation and ensure accurate results, the Remote Action allows these GUIDs to be provided as a configurable input parameter, helping password sign-ins be correctly detected and reported.\n\nThese insights help IT administrators evaluate Windows Hello deployment, monitor usage trends across the organization, and identify gaps to improve adoption.\n\nSupported Platforms: Windows 10, Windows 11

Facial Recognition Identifiers to be provided. Multiple keywords can be added separated with comma

Facial Recognition Identifiers

Fingerprint Recognition Identifiers to be provided. Multiple keywords can be added separated with comma

Fingerprint Recognition Identifiers

Custom GUIDs to identify password-based sign-in to be provided, if applicable. Multiple GUIDs can be added, separated with comma. If there are none, enter empty quotes ('') to skip this check

Custom Password Logon GUIDs

Get Windows Hello readiness and usage

The hardware readiness for Facial Recognition. The value can be either 'Ready' or 'Not Ready'. If the value is set to 'Ready', it means that the hardware is ready for Windows Hello Facial Recognition. If the value is set to 'Not Ready', it means that the hardware is not ready for Windows Hello Facial Recognition

Facial Recognition Hardware Status

The hardware readiness for Fingerprint. The value can be either 'Ready' or 'Not Ready'. If the value is set to 'Ready', it means that the hardware is ready for Windows Hello Fingerprint. If the value is set to 'Not Ready', it means that the hardware is not ready for Windows Hello Fingerprint

Fingerprint Hardware Status

The Windows Hello Enablement Status. The value can be either 'Enrolled' or 'Not Enrolled'. If the value is set to 'Enrolled', it means that the user has enrolled in Windows Hello. If the value is set to 'Not Enrolled', it means that the user has not enrolled in Windows Hello

Windows Hello User Enrollment Status

The last used sign-in method. The value can be either 'PIN', 'Password', 'Fingerprint', 'Facial Recognition'. If the value is set to 'PIN', it means that the user has used a PIN to sign in. If the value is set to 'Password', it means that the user has used a Password to sign in. If the value is set to 'Fingerprint', it means that the user has used a Fingerprint to sign in. If the value is set to 'Facial Recognition', it means that the user has used Facial Recognition to sign in

Last Used Sign-in Method

WMI biometric message retrieved in the biometric class

WMI biometric message

The Date and Time of the last used sign-in method. The value is in the format of 'yyyy-MM-ddTHH:mm:ss'

Windows Hello for business - Adoption

Description

Screenshots

Versions

Content

Required Products

Platforms

Compatibility