Adding ESS (Enhanced Signin Security) support to the script

[agpt8]

Hi there,

I noticed that under Win 11 Secure Core PC's section, there is a category that is not yet applied with the Hardening script, namely Enhanced Signin Security

Is this something that should be added explicitly or is it applied in some other way by the script?

I dont see the keys (specifically, SecureBiometrics and SecureFingerprint) in the Registery Editor at the path given in the section above.
Is this something that should be added to the script?

[HotCakeX]

Hi,
Microsoft security baselines include it, you can download it and search for Enhanced Sign-in Security (ESS) in the included Excel document. Although looks like we don't need to enable it because it's enabled by default according to the Group policy description

It was automatically enabled for me. Windows Security -> Device Security

[agpt8]

The Core Isolation page also does not list this:

I did check the hardware compatibility as per the given link, it seems my workstation does not meet the requirements.

Just one last query though, is there an easy way to know which all PCs and workstations support these? And if someone is building themselves a PC, how can they ensure that the parts they are selecting meet these requirements? Or is it even possible on desktop PCs?

[HotCakeX]

AFAIK PCs with computer cases don't support this feature. The webcam or fingerprint scanner should be internal not external to support ESS. So I think only laptops and tablets support this feature.

I'd be looking at business class laptops/tablets on the manufacturers' websites. They're the ones that have things like discrete TPM (dTPM) instead of the virtualized/firmware TPM (fTPM) found on normal consumer devices, etc.

Microsoft Surface products are easy, the business class versions are secured core and ship with all the additional security features that the consumer Surface products don't have.

[HotCakeX]

https://support.microsoft.com/en-us/windows/enhanced-sign-in-security-in-windows-936c06ed-4024-4521-921f-faa97925a16e

[HotCakeX]

https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-face-authentication

[agpt8]

This was really helpful. Thank you! I'll close the discussion.