Windows Hello for Business
Overview
Section titled “Overview”Windows Hello for Business (WHfB) uses a private key protected by the device’s TPM for key-based authentication. A PIN or biometric gesture unlocks the private key locally; the password is not sent over the network.
How It Works
Section titled “How It Works”- The device generates a public/private key pair and registers the public key in AD or Azure AD.
- During authentication, it signs with the private key, and the server verifies the signature with the public key.
- Deployment options include key trust and certificate trust.
Benefits
Section titled “Benefits”- Reduces dependence on passwords and can improve resistance to phishing.
- Combines a device factor (TPM) with a user factor (PIN or biometrics).
Considerations
Section titled “Considerations”- TPM availability, recovery methods, and device replacement processes matter.
- Check compatibility with existing Kerberos/AD integration and cloud identities.