How to set up Windows Hello securely

Step by step

1. 30 sec

   Navigate to Sign-in options

   Open the Settings app by pressing the Windows key + I. Select Accounts from the left-hand sidebar, then click on Sign-in options to view available authentication methods.

   Note: Win + I
2. 1 min

   Create a Windows Hello PIN

   Windows Hello requires a PIN as a recovery credential. Under Ways to sign in, click PIN (Windows Hello) and select Set up, then verify your user account password when prompted.

   Note: A strong alphanumeric PIN is more secure than a simple numeric sequence.
3. 1 min

   Enable Facial or Fingerprint recognition

   Select Facial recognition (Windows Hello) or Fingerprint recognition (Windows Hello). Click Set up to initialize the sensor hardware, then follow the on-screen prompts to scan your face or finger.

   Note: Ensure you are in a well-lit environment for optimal facial sensor performance.
4. 30 sec

   Configure dynamic lock settings

   Return to the Sign-in options menu and expand the Dynamic lock section. Check the box labeled Allow Windows to automatically lock your device when you're away to ensure your PC secures itself when your paired device moves out of Bluetooth range.

   Note: Ensure your phone is paired to your PC via Bluetooth before enabling this.
5. 1 min

   Enforce biometric-only access

   Under the Additional settings section in Sign-in options, toggle the switch for For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device to ON. This disables legacy password logins for Microsoft services on your machine.

   Note: This prevents secondary login methods that may bypass biometric hardware.