Microsoft’s efforts to tighten Windows sign-in security are creating a new headache for users who rely on external biometric devices. A feature called Enhanced Sign-in Security (ESS), baked into recent Windows 11 updates, is quietly blocking some fingerprint readers and infrared cameras from working at the lock screen. The issue, which has confused many users, is actually a deliberate security measure—but it’s also easily fixed once you know where to look.

What’s happening with Windows Hello peripherals?

The confusion stems from a setting that appeared in Windows 11 under different names depending on your version. On the latest 24H2 release, you’ll find Enhanced sign-in security in Settings > Accounts > Sign-in options > Additional settings. When this toggle is turned on, Windows will only accept biometric data from devices that meet Microsoft’s strict ESS criteria. That can lock out many external fingerprint scanners and third-party Hello cameras that worked perfectly before.

Things get trickier on version 23H2. There, the setting is labeled Sign in with an external camera or fingerprint reader, and it works in reverse: turning it on actually disables the security feature to let your peripherals work. Microsoft made the switch to reduce confusion, but anyone who upgraded and didn’t notice the label change may be left wondering why their fingerprint reader suddenly doesn’t respond.

This is not a driver bug or hardware failure. It’s a security trade-off. With ESS enabled, Windows locks down biometric authentication to sensors that have undergone additional hardening. A non-compliant device might still function inside apps—for video calls, for instance—but not at the Windows lock screen. Microsoft’s documentation advises against disabling ESS unless you understand the risk, but for many home users, getting their gear back online is the priority.

The bigger picture: Windows sign-in options in mid-2026

To truly understand what’s going on, you need to see the full sign-in landscape. Microsoft has been pushing toward a passwordless future for years, and the Settings page at Settings > Accounts > Sign-in options is the command center for that transition. Here you’ll find every method Windows supports: facial recognition, fingerprint, PIN, security key, and—on newer builds—passkeys.

Behind the scenes, there’s a deliberate separation of duties. Your Windows Hello PIN is not your Microsoft account password. It’s a device-only secret that never leaves your PC, protected by the computer’s TPM where available. That means a compromised PIN gives an attacker access to your local machine, but not your online email, OneDrive, or Microsoft 365. The password, meanwhile, remains the master key for your online identity. Microsoft recommends a strong, unique Microsoft account password backed by multi-factor authentication, and using a PIN (or biometrics) for daily device unlock.

Passkeys have also entered the mix. Starting with Windows 11 22H2 (KB5030310), Microsoft introduced a dedicated Settings > Accounts > Passkeys page where you can manage website and app credentials that sync via Windows Hello or your phone. This is part of a broader industry move away from typed passwords to cryptographic keys that resist phishing. Physical security keys—USB or NFC dongles—can also be managed here and add a very strong second factor.

When your fingerprint or face login isn’t working

If your biometric login has stopped working recently, the ESS setting is suspect number one. But before you toggle anything, rule out simpler causes. Check that your hardware is genuinely Windows Hello compatible: face recognition demands an infrared camera, not just an ordinary webcam. Fingerprint readers must be certified for Windows Hello—many generic USB scanners are not. Reconnect the device directly to the PC, bypassing any hub, and open Device Manager to look for warning icons on camera or biometric devices.

Once you’re sure the hardware is sound, locate the ESS control:
- Windows 11 24H2: Settings > Accounts > Sign-in options > Additional settings > Enhanced sign-in security. Turn it Off solely if you need a non-ESS external device for sign-in.
- Windows 11 23H2: The same path, but the toggle is labeled Sign in with an external camera or fingerprint reader. Turn this On to allow your peripheral to work; that disables ESS.

If you’re on a work or school PC, these options may be grayed out or missing entirely. Your organization can enforce hardware requirements or disable biometric sign-in through group policy. In that case, you’ll have to follow company-approved methods.

A better move than disabling security outright is to check with your device manufacturer for updated firmware. Many fingerprint readers and external cameras have received ESS-compatible firmware that lets them work with the protection enabled. Enable Windows Update, install optional driver updates, and visit the manufacturer’s support site before you flip that switch.

When you can’t remember your PIN or password

Forgetting a PIN doesn’t need to escalate into a full account-recovery drama. If you’re already signed into Windows, head to Settings > Accounts > Sign-in options > PIN (Windows Hello) and select I forgot my PIN. After verifying your account identity, you can set a new one.

Stuck at the lock screen? Look for the I forgot my PIN link beneath the PIN entry box. This will kick off an online verification flow for Microsoft accounts—you’ll need an internet connection and access to your registered recovery email or phone. If that fails, click Sign-in options under the PIN field, choose the password icon, and get into Windows that way. Then reset the PIN from Settings as above.

Passwords are a different matter. For a Microsoft account, hit I forgot my password at the sign-in screen or visit account.live.com/password/reset from another device. Successful recovery hinges entirely on having kept your security info current—update your phone number and alternate email before you need them. Local accounts are simpler: enter a wrong password, click OK, then select Reset password and answer your security questions. If you created a password reset disk on a USB drive earlier, you can use that to bypass the questions.

Administrators on the same PC can reset another local user’s password via Computer Management > Local Users and Groups (available on Pro editions and above). But be warned: this can make encrypted files or stored passwords inaccessible to that user.

Going passwordless with passkeys and security keys

While biometrics and PINs get you into Windows, passkeys and security keys are your ticket to a safer online life. A passkey is a cryptographic pair tied to a website or app; instead of typing a password, you confirm with your fingerprint, face, or PIN. Because the credential is bound to the specific site, it can’t be phished.

On Windows 11, open Settings > Accounts > Passkeys to see any device-bound passkeys you’ve created. You can delete them individually or, under Advanced options, choose where new passkeys are saved—on the device itself, in a synced credential manager (like the one built into Microsoft Edge), or on a smartphone. Microsoft has also opened the door to third-party passkey providers on version 24H2.

Physical security keys are a step up in protection. To manage one, plug it in and go to Settings > Accounts > Sign-in options > Security key > Manage. Windows will walk you through enrollment. Microsoft permits up to 10 security keys per work or school account when the organization supports them. For personal Microsoft accounts, you can add a key from the online account dashboard under Security > More security options.

Always register at least one backup sign-in method. A lost security key with no alternative can lock you out just as thoroughly as a forgotten password.

Lock screen and privacy settings you should review

How quickly Windows locks after you leave isn’t just a convenience setting—it’s a security boundary. Under Additional settings, look for If you’ve been away, when should Windows require you to sign in again? Set this to require sign-in every time the PC wakes, especially on laptops and shared machines. For a desktop in a controlled room, you might stretch it, but the safest baseline is “Every time.”

Dynamic lock adds a belt-and-suspenders layer: pair your phone over Bluetooth, then enable Allow Windows to lock your device automatically when you’re away. The PC will lock roughly a minute after the phone goes out of range. It’s handy, but it won’t unlock when you return, and Bluetooth distance isn’t precise. Make a habit of pressing Windows key + L whenever you step away.

Another often-overlooked setting controls what’s visible on the lock screen before you sign in. Toggle Show account details on the sign-in screen off for any laptop or PC used in public places. Leaving your email address visible gives a stranger one less step to a targeted attack.

Skip the old netplwiz trick for automatic logon unless the PC is a kiosk or strictly physically secured. Microsoft’s current documented automatic-logon methods require registry edits and still are considered a significant risk for devices containing personal or financial data.

A quick security checkup for your Windows sign-in

Use this short list to audit your own device:

  • Your Microsoft account password is unique, strong, and backed by up-to-date recovery info.
  • Your Windows Hello PIN is at least six digits (letters and symbols are better) and not based on easy-to-guess numbers.
  • Face or fingerprint login is enrolled, but always keep the PIN as a fallback.
  • For fingerprint readers, enroll at least two different fingers.
  • Check the ESS/external camera setting against your actual hardware needs.
  • Hide account details on the lock screen if the device leaves your home.
  • Require sign-in after sleep.
  • Dynamic lock is on, but you still manually lock with Windows+L.
  • No automatic logon.

Outlook

Microsoft’s drive toward a passwordless, phishing-resistant world isn’t slowing down. Upcoming Windows updates will likely refine passkey management further and could unify the sign-in options experience across Windows 11 and future releases. For now, the controls are all there—you just need to know which toggle does what. Taking fifteen minutes to audit your sign-in settings will save you far more time when something inevitably goes wrong.