When I log in to my computer using fingerprint without issue if the account is the domain one. However, if I want to log onto local account I get error "windows couldn't sign you in. Your credentials could not be verified". I need then to log in using username and password with specifying local domain (computer name).

Curiously, it wasn't the case before i had to factory reset the machine. Computer is brand new, and before factory reset i had somewhat opposite issue - could not log in to domain using fingerprint (option disabled in GP). I messed with Windows Hello in different ways to make it work and probably then set it up so it worked perfectly by accident.

Is there a way to set it up properly? The way it works right now defeats completely the purpose of using fingerprint.

Not using Microsoft account, only local account and domain account at work.

If I log on to my local account after reboot first, it works from then on until next reboot.

However, if I log on to domain account first, I now get the message (when subsequently logging in to local account): Your password was changed on another device. You must log on using your credential once and after that you can then use Windows Hello. This happens with every reboot.

I have GP logon/Assign a default domain for logon set to local domain (tried both option with . and [computername]. Still doesn't work. I guess that's not it.


On my machine (Windows 10 version 1709) works fine with Windows Hello fingerprint both for domain and local account in same time. When I scan my right hand sum then I log in to my domain account, and with my left for local account.

It may depend to your domain's group policy and your windows version. (reference: https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization ).

And possibly you can enable Windows Hello locally, by setting the following registry and rebooting while your computer is not connected to network.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System] "AllowDomainPINLogon"=dword:00000001


Your domain account and local account are different instance on your computer, so Windows Hello fingerprint is stored separately. You may have to register fingerprint for local account and domain account separately.

  • Windows Hello does not allow use same fingerprint to be registered for two accounts... And it's not the fingerprint that's the issue because WH recognizes it always. Just not allowing to log in with it always. – AcePL May 16 '18 at 12:18
  • Thank you, AcePL ! Windows Hello knows which finger is associated to which account, and this association is one-to-one. Then, because we have one or more fingers on my hands, and we can assign the index-finger for account A, and the middle-finger for account B. – takahar tanak May 18 '18 at 2:28
  • Not quite - you can have multiple fingerprints associated with one account. Also you're describing the WH setup I have right now which is working as far as biometrics actually being used and recognized. Still, it doesn't answer my question, which is why WH requires ADDITIONAL credentials from me when logging in as described. – AcePL May 21 '18 at 9:32
  • Nothing to complain about the biometrics itself, it seems WH has issues with the logging in process, which is at this point past fingerprint recognition. – AcePL May 21 '18 at 9:57

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.