Germany’s Federal Office for Information Security (BSI) has published findings from a reverse-engineering study showing that Windows Hello for Business facial authentication can be fooled by presentation attacks and is poorly defended against local tampering when Enhanced Sign-in Security (ESS) is not used. The analysis, conducted by ERNW on behalf of the BSI and dated July 2026, examined Windows 10 Enterprise LTSC 2021 and underscores that a TPM-protected cryptographic key is only half the security story.

What the BSI Researchers Found

The study concentrated on the facial recognition component of Windows Hello for Business. Researchers uncovered two broad categories of risk—neither of which means Windows Hello is broken, but both highlight practical limits of relying on biometrics without extra hardware-backed isolation.

First, the local post-compromise scenario. On a device without ESS, the biometric database and associated processes live substantially within the normal Windows environment. The BSI analysis found that an attacker who gains administrative or kernel-level control can tamper with enrollment records and, critically, the mapping between a stored biometric template and the user’s Windows security identifier (SID). If that SID association is altered, a successful face match could cause Windows to release the legitimate user’s enterprise authentication key after the attacker presents a different person’s face—or even a manipulated biometric record. The private key itself, protected by the Trusted Platform Module (TPM), is never extracted, but the authorization to use it is hijacked.

Second, the researchers demonstrated two presentation attacks. They enrolled a facial mask of a target user into Windows Hello and later authenticated successfully with a different mask of the same person. In another test, a user registered their face while wearing a scarf, glasses, and a hood. After enrollment, another individual wearing the same accessory combination was able to sign in. When the original user re-enrolled without those obstructions, the false acceptance vanished. These tests reveal that enrollment quality and sensor anti-spoofing capabilities directly determine how robust the biometric gate is—and that some Windows Hello cameras can be tricked by artificial artifacts or degraded enrollment conditions.

Why a TPM Isn’t Enough

Windows Hello for Business is built on a powerful idea: instead of a reusable password, the device holds a cryptographic key pair, and the TPM safeguards the private key. During sign-in, a biometric gesture or PIN authorizes use of that key, and the remote identity provider sees only a cryptographic proof. This design drastically reduces the risk of phishing and credential theft. Microsoft’s documentation makes this architecture clear.

The catch is that protecting the key and protecting the decision to use it are two separate problems. In a standard non-ESS deployment, the Windows Biometric Service runs in the normal operating system, facial templates are stored in a local database under C:\WINDOWS\System32\WinBioDatabase, and the encryption key for that database is itself available on the same system. The BSI report notes that the “protection does not use an external secret that remains unavailable to the operating system.” In other words, a sufficiently privileged attacker does not need to break the TPM; they can simply manipulate the biometric chain to make Windows believe the correct face was presented.

This is why the German agency’s analysis draws a clear line between the cryptographic key’s security and the security of the entire biometric authorization flow. The TPM is a fortress for the key, but the drawbridge—the biometric decision itself—is still controlled by processes running in the same potentially compromised OS.

How Enhanced Sign-in Security Fixes the Problem

Enhanced Sign-in Security (ESS) is Microsoft’s solution to this exact gap. It rearchitects Windows Hello biometrics around hardware-backed isolation. For facial recognition, ESS requires a compatible infrared camera, TPM 2.0, and Virtualization-based Security (VBS). The face-matching algorithm runs inside a VBS enclave, isolated from the normal Windows environment. Camera data flows through a protected channel, and templates are generated and stored using keys that exist only within that enclave. For fingerprints, ESS demands match-on-sensor hardware that performs matching on the sensor itself and establishes a secure session with VBS biometric components.

The result is that the entire biometric decision—from sensor to match to identity confirmation—happens in a trusted execution environment, and the authorization signal to the TPM travels over a secure channel. No matter how deeply the main Windows OS is compromised, attacker code cannot intercept or manipulate that decision.

Microsoft publicly documents these requirements. Administrators can verify whether a sensor is running under ESS isolation by checking Event Viewer under Applications and Services Logs > Microsoft > Windows > Biometrics > Operational for Event ID 1108; it shows whether the sensor is in a Virtual Secure Mode process or a standard System process.

Who Is Affected and How Urgent Is This?

The risk tier depends on your role and device.

For enterprise IT admins: This should trigger an immediate audit. Organizations running mixed hardware fleets—some with ESS-capable PCs and many without—are exposing high-value accounts to local tampering if those devices lack ESS. Privileged administrators, finance staff, and developers with production access are prime targets. The BSI findings also highlight that shared workstations or laptops left unattended in public spaces raise the stakes.

For home users and small businesses: Most consumer laptops ship with basic Windows Hello face cameras that do not support ESS. The threat of a local attacker physically compromising your device and manipulating biometric data is lower for a typical home user, but a lost or stolen laptop becomes a serious concern. If someone can boot the machine and gain administrative access (e.g., through an offline attack), the biometric lock may be weaker than you assume. Users should treat Windows Hello face login as a convenience layer, not a high-security barrier, unless ESS is confirmed.

For developers and power users: If you run with local administrator rights (as many do), your device is more exposed to the post-compromise threat. Any malware that escalates to admin could potentially subvert the biometric path. ESS is especially valuable here.

Action Plan: 5 Steps to Stronger Windows Hello Biometrics

  1. Inventory your ESS status immediately. Check Settings > Accounts > Sign-in options for an “Enhanced sign-in security” indicator. For fleet-wide visibility, use the Event Viewer method or Microsoft Endpoint Manager to query biometric sensor isolation. Do not assume that a Windows Hello camera implies ESS.

  2. Prioritize ESS-capable hardware for sensitive roles. Enforce a procurement policy that any device used by privileged accounts, executives, or those handling regulated data must support ESS. When ESS is enabled, non-ESS biometric sensors are blocked by the Windows Biometric Framework—by design.

  3. Require TPM-backed provisioning and anti-spoofing. Configure Windows Hello for Business to mandate a hardware security device (so software-based key protection is impossible) and enable the “Enhanced anti-spoofing” policy where hardware supports it. This setting disables face authentication on devices that lack proper anti-spoofing capabilities.

  4. Harden the endpoint. Remove standing local administrator rights, enforce Device Encryption and Secure Boot, and deploy endpoint detection tools that monitor for credential-access attempts. Reducing the chance that an attacker gains administrative control is the first line of defense.

  5. Treat biometric enrollment as a security ceremony. Write down a policy: enrollment must be done in a well-lit, controlled environment with the user’s full, unobscured face visible. For high-assurance accounts, consider supervised enrollment. Re-enroll after sensor replacement or suspicious events, and have a secure PIN fallback—Windows Hello always requires a PIN as backup, so make sure your PIN policies are strong.

The Bigger Picture: Biometric Maturity Is Still a Work in Progress

The BSI’s research doesn’t invalidate Windows Hello’s passwordless benefits. Compared to passwords, a TPM-backed device-bound key is a massive security improvement, and for most remote attacks, it works. But biometrics aren’t magic. They are probabilistic sensors interpreted by software, and that interpretation needs hardware-grade isolation to be trustworthy.

Apple’s Face ID uses a Secure Enclave to similarly isolate biometric processing from the main OS. Microsoft’s ESS is the Windows answer, and the industry is clearly moving toward this model. Future Windows releases may eventually require ESS for face authentication by default. Until then, the responsibility falls on IT departments and power users to understand the difference between a cryptographic credential and the biometric tunnel that unlocks it—and to configure their devices accordingly.