Article Intended For

Penn State employees whose Penn State-managed Windows computer has been enabled to enroll in Windows Hello for Business.

Introduction

Windows Hello for Business provides a phishing-resistant, passwordless way to sign in to your Penn State-managed Windows computer as well as sites and services. To use Windows Hello for Business, you must first create a PIN for your device. If your hardware supports it, you can also add fingerprint or facial recognition and use those instead of entering the PIN each time.

Things to know:

• Windows Hello for Business must first be enabled for your managed Windows computer. If your computer is managed by Penn State IT's Deskside Support team, it should already be enabled for you to enroll. If your device is not managed by Deskside Support, you will need to contact your local IT (the staff who manage your device) to request this. If you are unsure of who that is, contact the IT Service Desk for assistance: https://www.it.psu.edu/support/
  
  
• If your device is enabled to enroll, you must first connect to GlobalProtect VPN before proceeding with the enrollment steps below. We also recommend first connecting to GlobalProtect VPN, restarting your computer, ensuring you are again connected to GlobalProtect VPN, then following the instructions below.
  
  
• Your Windows Hello PIN is not your Penn State Account password. It is specific to the computer itself.
  
  
• Windows Hello for Business is device-bound. It must be enabled separately on each eligible Penn State-managed computer. If you register on your managed computer, it does not follow you to other computers that are not specifically set up for you.
  
  
• A PIN must be configured before fingerprint or facial recognition can be added (if supported).
  
  
• If you configure fingerprint or facial recognition, your PIN remains available as a backup sign-in method.

Article Body

How Do I Enroll in Windows Hello for Business?

NOTE: As stated earlier in this article, Windows Hello for Business must first be enabled for your managed Windows computer and you must be connected to GlobalProtect VPN. If your computer is managed by Penn State IT's Deskside Support Team, it should already be enabled for you to enroll. If your device is not managed by Deskside Support, you will need to contact your local IT (the staff who manage your device) to request this. If you are unsure of who that is, contact the IT Service Desk for assistance: https://www.it.psu.edu/support/

1. In the Windows Search bar, type "Sign-in options" and select it from the search results
   
   
   
   
   
   
2. Under Ways to sign in, select PIN (Windows Hello)
   
   
   
   
3. Select Set up
   
   
4. When prompted, verify your identity using your Penn State Account credentials and MFA
   
   
5. Enter the PIN you want to use in the New PIN field and confirm it in the Confirm PIN field. Your PIN must be a minimum of 6 characters.
   
   
6. Select OK
   
   

Your Windows Hello for Business credential is now configured on your computer.

Optional: Add Fingerprint Recognition

NOTE: If your computer does not have a compatible fingerprint reader installed, this option will not work.

1. In the Windows Search bar, type "Sign-in options" and select it from the search results
   
   
   
   
   
   
2. Select Fingerprint recognition (Windows Hello)
   
   
   
   
3. Select Set up
   
   
4. Select Get started
   
   
5. Enter your Windows Hello PIN when prompted
   
   
6. Place and lift your finger on the fingerprint reader repeatedly as instructed on the screen
   
   
   
   
7. Continue until you receive confirmation that fingerprint setup is complete
   
   
   
   
8. Select Close
   
   
   
   

Optional: Add Facial Recognition

NOTE: If your computer does not have an internal (or external) webcam installed that is capable of performing facial recognition, this option will not work.

1. In the Windows Search bar, type "Sign-in options" and select it from the search results
   
   
   
   
   
   
   
2. Select Facial recognition (Windows Hello)
   
   
   
   
3. Select Set up
   
   
4. Select Get started
   
   
5. Enter your Windows Hello PIN when prompted
   
   
6. Look directly at the camera while Windows scans your face
   
   
   
   
7. Your face will be scanned a few times before you receive confirmation that the process has been completed
   
   
   
   
8. Select Close

How Do I Sign In With Windows Hello for Business?

1. Visit a Penn State website you want to log into (example: https://accounts.psu.edu/ )
   
   
2. Enter your Penn State Account username and select Next (or press the ENTER key on your keyboard)
   
   
3. If prompted, select Sign in with a passkey
   
   
4. If prompted with the Windows Security - Choose a passkey window, select your Penn State Account
   
   
5. Enter your Windows Hello PIN, or use your configured fingerprint or facial recognition
   
   NOTE: If you have fingerprint or facial recognition enabled, a prompt to complete verification with this method will appear directly after entering your Penn State Account username.
   
   

After windows verifies your identity, you are signed in.

If You Receive "Your Credentials Could Not Be Verified"

If you receive this error message, follow these steps:

1. select OK to close the error
   
   
2. select Sign-in options
   
   
3. select the Password option
   
   
4. enter your Penn State Account password to sign in to Windows
   
   
5. once signed in, connect to GlobalProtect VPN
   
   
6. once connected, lock your computer by pressing Windows key + L
   
   
7. on the lock screen, select Sign-in options (if prompted)
   
   
8. select PIN (Windows Hello)
   
   
9. enter your Windows Hello PIN
   
   This should resolve the issue. If you continue to receive the error, contact your local IT support (the people who manage your device). If you are unsure who that is, submit a ticket to the IT Service Desk and be sure to include your device serial number or computer name: https://it.psu.edu/support/