How to Disable Windows Hello on Windows 10 and 11

Windows Hello is Microsoft's biometric authentication system, letting you sign into your PC using facial recognition, a fingerprint, or a PIN instead of a traditional password. For many users it's a genuine convenience — but there are legitimate reasons to want it turned off. Maybe you share a workstation, manage a device through IT policy, or simply prefer entering a password the old-fashioned way.

Disabling Windows Hello isn't complicated, but the exact steps — and what's actually possible — depend on your Windows version, whether your device is personally owned or managed by an organization, and which Hello methods you have set up.

What Windows Hello Actually Does

Windows Hello replaces or supplements your Microsoft account or local account password with faster, device-based authentication. It works through three main methods:

• PIN — a numeric or alphanumeric code tied to your specific device
• Fingerprint — requires compatible fingerprint hardware
• Facial recognition — requires an IR (infrared) camera, not just a standard webcam

Each method is stored locally on the device, not in the cloud, which Microsoft positions as a security advantage. The Trusted Platform Module (TPM) chip on your device handles the cryptographic keys that make this work.

Understanding that distinction matters when you try to remove Hello: you're not deleting a password from a server, you're removing locally enrolled credentials and potentially disabling the prompts that encourage or require their use.

How to Remove Windows Hello Sign-In Methods

Removing a PIN

1. Go to Settings → Accounts → Sign-in options
2. Under PIN (Windows Hello), select Remove
3. Windows will ask you to confirm your account password before the PIN is deleted

On Windows 11, the layout is slightly reorganized but the path is the same. If the Remove button is grayed out, it typically means your device or account is configured to require Hello sign-in — often enforced by a work or school account policy.

Removing Fingerprint or Face Recognition

1. Go to Settings → Accounts → Sign-in options
2. Locate Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello)
3. Select Remove under the enrolled method

If you have multiple fingerprints saved, removing the Windows Hello enrollment clears all of them at once — there's no option to delete individual fingers in the standard Settings UI.

Disabling Windows Hello Entirely via Group Policy

If you want to prevent Windows Hello from being set up at all — rather than just removing your current enrollment — Group Policy gives you that control. This option is available on Windows 10 and 11 Pro, Enterprise, and Education editions. Home edition users don't have access to the Group Policy Editor.

1. Press Win + R, type gpedit.msc, and press Enter
2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → Windows Hello for Business
3. Open Use Windows Hello for Business and set it to Disabled

This setting prevents Hello for Business enrollment but may not fully suppress the consumer Hello prompts for local or personal Microsoft accounts. For those, a registry edit is the alternative.

Registry Method (for Windows Home or Fine-Grained Control)

1. Press Win + R, type regedit, press Enter
2. Navigate to: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftPassportForWork
3. Create a new DWORD (32-bit) Value named Enabled and set its value to 0

If the PassportForWork key doesn't exist, you can create it manually. As with any registry change, backing up the registry first is worth the extra two minutes. 🔒

Variables That Affect What's Possible

Not every Windows Hello removal looks the same. Several factors shape what options are actually available to you:

Devices enrolled in a corporate environment through Azure Active Directory or managed via Microsoft Intune often have Hello policies enforced at the organizational level. In those cases, even if you navigate to the right settings screen, the options may be read-only or absent entirely — and changing them would require your IT administrator.

What Happens After You Disable It 🖥️

Once Windows Hello methods are removed or disabled, Windows falls back to your account password for sign-in. If you're using a Microsoft account, that's your Microsoft account password. If you have a local account, it's the password you set for that account.

Some users find that Windows 11 in particular continues to prompt them to set up a PIN even after removal — this is part of Microsoft's push toward passwordless authentication. The Group Policy or registry approach described above suppresses these prompts more reliably than simply removing the enrollment through Settings.

It's also worth noting that third-party applications that use Windows Hello for authentication (password managers, banking apps, some VPNs) will fall back to their own alternative sign-in methods once Hello is no longer available on the device.

The Part That Depends on Your Setup

Whether removing Windows Hello is straightforward or requires extra steps comes down to factors that vary significantly from one machine to the next. A personally owned Windows 11 Home laptop behaves differently from a work-issued Pro device joined to a corporate domain. An older machine without TPM 2.0 has different constraints than a modern ultrabook built around Windows Hello hardware.

The steps above cover the main scenarios, but the specific combination of your Windows edition, account type, and whether your device is managed will determine which path actually applies — and whether any of those options are available to you at all.