Use certificate for on-premises authentication

Supported OS tags: Windows10, Windows10RT

Use this policy setting to configure Windows Hello for Business to enroll a sign-in certificate used for on-premises authentication. If you enable this policy setting, Windows Hello for Business enrolls a sign-in certificate that is used for on-premises authentication. If you disable or do not configure this policy setting, Windows Hello for Business will use a key or a Kerberos ticket (depending on other policy settings) for on-premises authentication. NOTE: Disabling or not configuring this policy setting and enabling the "Use Windows Hello for Business" policy setting requires the environment to have one or more Windows Server 2016 domain controllers to prevent Windows Hello for Business authentication from failing.

This policy has no additional user input fields.

• Computer
  Allow enumeration of emulated smart card for all users

  At least Windows 10
• Computer
  Configure device unlock factors

  At least Windows 10
• Computer
  Configure dynamic lock factors

  At least Windows 10
• Computer
  Enable ESS with Supported Peripherals

  At least Windows 11 Version 22H2
• Computer
  Turn off smart card emulation

  At least Windows 10
• Computer
  Use a hardware security device

  At least Windows 10
• Computer
  Use biometrics

  At least Windows 10
• User
  Use certificate for on-premises authentication

  At least Windows 10
• Computer
  Use cloud trust for on-premises authentication

  At least Windows 10
• Computer
  Use PIN Recovery

  At least Windows 10
• User
  Use Windows Hello for Business

  At least Windows 10
• Computer
  Use Windows Hello for Business

  At least Windows 10