Disable Biometrics in Windows 11 and 10: Turn Off Fingerprint and Face Sign-In (Every Way)

To turn off fingerprint or face sign-in in Windows 11, open Settings and go to Accounts, then Sign-in options. Expand Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello) and select Remove. That deletes your biometric data from the PC, and you sign in with your PIN or password instead. To disable biometrics for every user so nobody can set them up again, set the Group Policy Allow the use of biometrics to Disabled, under Windows Components and then Biometrics. On Windows 11 Home, create the registry value Enabled=0 under HKLM\SOFTWARE\Policies\Microsoft\Biometrics. Stopping the Windows Biometric Service or disabling the reader in Device Manager also works, but it is more blunt. Your fingerprint and face data stay on the PC and are not uploaded to Microsoft.

Ethan's laptop came with a fingerprint reader, and for a year he loved it. Then his teenage son discovered that pressing his father's finger to the reader while he dozed on the sofa unlocked the laptop. It was harmless mischief, but it made Ethan think. He asked Jake how to turn fingerprint sign-in off, and whether Microsoft had a copy of his fingerprint. Jake removed the fingerprint in Settings, which took ten seconds, and showed Ethan that the PIN still worked for sign-in. He also explained that Windows keeps biometric data only on the device, in a form that cannot be turned back into a fingerprint image. Ethan later added a fingerprint again, from his other hand, and set the laptop to lock sooner. This page covers every way to turn off fingerprint and face sign-in in Windows 11 and 10, for yourself or for all users, how to delete biometric data, what happens to passkeys and the PIN, and how to turn biometrics back on.

What biometrics mean in Windows

In Windows, biometrics means signing in with a physical feature instead of something you type: your fingerprint, read by a fingerprint sensor, or your face, recognized by an infrared camera. Both are part of Windows Hello, Microsoft's name for its sign-in methods, which also include the PIN. Our guide to what Windows Hello is explains how the pieces fit together.

Biometrics are a convenience layer on top of the PIN. When you set up fingerprint or face sign-in, Windows requires a PIN first, and the PIN remains the fallback if the sensor fails, your finger is wet, or the light is wrong. Biometrics also unlock the same things the PIN does, such as passkeys for websites, password manager vaults that use Windows Hello, and confirmations in apps.

People turn biometrics off for several reasons: concern about someone using their finger or face without consent, as in Ethan's case; a shared PC where only one person should sign in; workplace rules; a faulty sensor that keeps prompting; or simple preference for a PIN. Each reason points to a slightly different method, from removing your own data to blocking the feature for everyone.

Not every PC has biometric hardware. Fingerprint readers are often built into the power button or near the touchpad, and face recognition needs a Windows Hello-compatible infrared camera, not just a webcam. Our guide to checking for a fingerprint reader shows how to tell what your PC has.

Turn off fingerprint or face sign-in for your account

Removing your biometric sign-in is the right method for most people. It turns the feature off for your account and deletes the stored data, without affecting anyone else on the PC.

1. Open Settings with Windows + I.
2. Select Accounts, then Sign-in options.
3. Under Ways to sign in, select Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello) to expand it.
4. Select Remove. Windows may ask you to confirm with your PIN or password.
5. Repeat for the other method if you set up both.

Once removed, the sign-in screen no longer asks for your finger or face, and the data for your account is deleted from the PC. You sign in with your PIN or password from then on. To use biometrics again later, return to the same page and select Set up.

If you only want to stop face recognition from unlocking the PC automatically, without removing it, look in the Facial recognition section for Automatically dismiss the lock screen if Windows recognizes your face, and turn it off. Windows will then recognize your face but wait for you to press a key or swipe before dismissing the lock screen, which some people find more comfortable.

Removing a single finger is not offered as a separate option: Remove deletes all fingerprints for your account. If you want to change which fingers are enrolled, remove them all, then select Set up and add the ones you want, using Add a finger for each extra one. Ethan enrolled only his left index finger the second time, which his son found much less convenient to borrow.

Turn off fingerprint or face sign-in in Windows 10

Windows 10 has the same options in a slightly different layout. Open Settings, Accounts, Sign-in options, and select Windows Hello Fingerprint or Windows Hello Face in the list of ways to sign in. Select Remove under the method. Older Windows 10 versions show the methods as separate sections with Set up, Add another and Remove buttons.

The Group Policy, registry and service methods below work the same in Windows 10. Windows 10 is past its October 2025 end of support except for PCs enrolled in Extended Security Updates, and the Windows Hello settings have not changed since; if your PC is moving to Windows 11, you will need to set up biometrics again there anyway, since enrollments are tied to the device and installation.

Every method compared

The methods on this page differ in scope and in how easily they are undone. This table helps you pick the right one.

Combining methods is fine. A family PC might use the policy to block biometrics for the children's accounts' sake, while the parents simply never enroll; a PC being retired should be reset regardless of anything else.

Disable biometrics for all users with Group Policy

To stop anyone on a PC from using biometrics, including setting them up, use Group Policy on Windows 11 and 10 Pro, Enterprise and Education. You need an administrator account; our guide to checking for an administrator account shows how to confirm it.

1. Open the Local Group Policy Editor by running gpedit.msc from the Run box (Windows + R).
2. Go to Computer Configuration, Administrative Templates, Windows Components, Biometrics.
3. Double-click Allow the use of biometrics, select Disabled, and select OK.
4. Optionally, also set Allow users to log on using biometrics and Allow domain users to log on using biometrics to Disabled, for clarity.
5. Restart the PC, or run gpupdate /force and sign out.

With Allow the use of biometrics disabled, fingerprint and face options disappear or are grayed out in Sign-in options for every user, existing enrollments stop working, and apps cannot use biometrics either. The PIN and password continue to work. To reverse it, set the policy back to Not Configured.

The Biometrics folder also contains a Facial Features subfolder with a policy to require enhanced anti-spoofing for face recognition, which demands cameras that can detect photos and masks. Organizations that allow face sign-in sometimes use it to raise the bar rather than disabling faces entirely.

The Biometrics policies explained

The Biometrics folder in Group Policy holds several settings, and their names are similar enough to cause confusion. This table explains what each one does.

For a simple off switch, the first policy is all you need. The sign-in policies are useful when you want apps to keep using biometrics, for example to confirm purchases, while Windows sign-in itself requires a PIN or password. Organizations using Windows Hello for Business have further policies under Windows Components, Windows Hello for Business, which control the PIN and biometrics for work accounts.

Disable biometrics in Windows 11 Home with the registry

Windows 11 and 10 Home have no Group Policy editor, but the same policy can be set in the registry. Create a restore point, or export the key you are about to change, before you start.

1. Open Registry Editor by running regedit from the Run box, opened with Windows + R, and accept the permission prompt.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft.
3. Right-click Microsoft, choose New, Key, and name it Biometrics if it does not exist.
4. In the Biometrics key, create a DWORD (32-bit) Value named Enabled and set it to 0.
5. Restart the PC.

From an administrator Command Prompt, one line does the same:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics" /v Enabled /t REG_DWORD /d 0 /f

To turn biometrics back on, delete the Enabled value, or set it to 1, and restart. If you find this value on a PC where you never set it, a tweak tool or a previous owner's setup probably created it, and deleting it restores normal behavior.

Stop the Windows Biometric Service

The Windows Biometric Service handles fingerprint and face sensors for Windows and apps. Stopping it and setting it to Disabled turns off all biometrics on the PC, for everyone, without any policy. It is a blunt tool, useful when biometrics misbehave or when policy editing is not an option, but the policy is the cleaner way to switch the feature off on purpose.

Press Windows + R, run services.msc, find Windows Biometric Service, double-click it, set Startup type to Disabled, select Stop, and select OK. Sign-in options will show fingerprint and face as unavailable. Note the startup type before you change it. To restore the service, set it back to that value, usually Manual or Automatic depending on the PC, and restart.

On some PCs, especially those with Enhanced Sign-in Security, Windows may resist or reverse changes to this service, since it is part of a protected sign-in system. If the service will not stay disabled, use the policy method instead.

Disable the fingerprint reader or IR camera itself

If you want the hardware off entirely, for example on a PC where the fingerprint reader keeps throwing errors, disable the device. Right-click Start, open Device Manager, expand Biometric devices, right-click the fingerprint sensor, and choose Disable device. For face recognition, the infrared camera usually appears under Cameras or Biometric devices with a name mentioning IR; disable that entry, not your regular webcam.

Many laptops can also disable the fingerprint reader or IR camera in their firmware settings, the BIOS or UEFI setup, opened with a key such as F2, F10, Del or Esc at startup depending on the manufacturer. That is the most complete way to turn off hardware, since Windows cannot see the device at all, and it survives Windows reinstalls.

Disabling the device is easy to undo: right-click it in Device Manager and choose Enable device, or turn it back on in the firmware. After re-enabling, you may need to set up fingerprint or face sign-in again.

Where Windows stores your biometric data, and how to delete it

Windows stores biometric data locally on the device, never in your Microsoft account or the cloud. What it stores is not a photo of your face or an image of your fingerprint but a template, a mathematical representation used for matching, which is designed so that the original image cannot be reconstructed from it. It is stored encrypted, tied to the specific PC.

The templates live in a protected system folder, C:\Windows\System32\WinBioDatabase, in database files that only the Windows Biometric Service uses. On PCs with Enhanced Sign-in Security, which many newer laptops including Copilot+ PCs use, the templates are protected further, with matching done in an isolated, virtualization-protected environment that the rest of Windows cannot reach.

The right way to delete your data is Remove in Sign-in options, which deletes your templates. Removing every user's enrollment, or resetting Windows, deletes all of it. Deleting files in WinBioDatabase by hand is not recommended: it requires stopping the service and taking ownership of system files, and can break biometric sign-in for everyone until it is set up again. If you are giving away or selling a PC, Reset this PC with the Remove everything option deletes biometric data along with everything else.

Common myths about Windows biometrics

A few beliefs about Windows biometrics come up again and again. Myth: Microsoft keeps a database of users' fingerprints. Windows Hello templates stay on each device and are not uploaded. Myth: a webcam photo can unlock face sign-in. Windows Hello face recognition uses infrared cameras and depth cues, and certified hardware rejects photos. Myth: biometrics replace your password entirely. They sit on top of a PIN, and your account password still exists for recovery and other devices.

Myth: removing biometrics leaves traces behind. Remove deletes your templates; nothing usable remains for your account. Myth: turning biometrics off makes the PC less secure. A good PIN is just as secure for most people; biometrics mainly add convenience. Knowing these makes the decision to keep or remove biometrics a calm one rather than a worried one.

What happens to your PIN and passkeys

Turning off biometrics does not turn off Windows Hello as a whole. Your PIN stays, and remains the main way to sign in, along with your password. That matters, because many things now depend on Windows Hello: passkeys for websites and apps, which you confirm with Windows Hello, keep working with the PIN; password managers and banking apps that use Windows Hello to unlock fall back to the PIN; and Microsoft account sign-in with the passwordless option uses the PIN.

If you want to remove the PIN too, our guide to removing the PIN explains how, including the setting that grays out the Remove button. Be aware that removing the PIN can affect passkeys stored on the PC, which may need to be recreated or replaced with passkeys on your phone.

If your PIN itself stops working after changes, with messages such as "Something happened and your PIN isn't available", our guide to fixing an unavailable PIN covers it.

Fingerprint, face or PIN: which is most secure?

All three Windows Hello methods are tied to the specific device, which is their main security advantage over passwords: a stolen PIN or a copied fingerprint is useless without the PC itself. Beyond that, each has its own profile. A PIN is something you know; it cannot be taken from you while you sleep, and Windows locks it after repeated wrong guesses, but it can be watched over your shoulder. A fingerprint is quick and works in any light, but can be pressed onto the sensor by someone with physical access to you. Face recognition on certified infrared cameras resists photos and simple masks, works hands-free, and is convenient on laptops, but unlocks as soon as you look at the screen unless you turn off automatic dismissal.

For most people, the difference in practical security is small, and the choice is about convenience and personal comfort. The biggest real-world gains come from using Windows Hello at all instead of a password typed at every sign-in, locking the PC when you leave it, and keeping the PIN private. If physical coercion or covert use by people close to you is a concern, a PIN alone is the strongest choice, which is the reasoning behind turning biometrics off in those situations.

Biometrics in browsers and apps

Windows Hello is not only for signing in to Windows. Browsers and apps use it to confirm your identity: Edge and Chrome can ask for Windows Hello before filling saved passwords or payment cards, websites that support passkeys use Windows Hello to sign you in without a password, and password managers, banking apps and Microsoft Store purchases can use it for confirmation.

When you remove biometrics, all of these switch to asking for your PIN, so nothing stops working. When you disable biometrics by policy, the same happens for every user. If you want to keep biometrics for Windows sign-in but not for a particular browser or app, look in that app's settings; for example, browsers have an option under their password or autofill settings to require device authentication, which you can change independently.

Passkeys deserve a note: they are stored on the device and unlocked with Windows Hello, so they stay usable with a PIN after you turn off biometrics. If you remove the PIN too, or reset the PC, passkeys stored on the PC are lost, and you will need another way to sign in to those sites, such as a passkey on your phone or a password.

Enhanced Sign-in Security on newer PCs

Many PCs sold in recent years, especially those with compatible fingerprint readers and IR cameras, use Enhanced Sign-in Security, often shortened to ESS. It isolates biometric matching and templates using virtualization-based security, which makes biometric sign-in much harder to attack, even for malware running on the PC. It is usually turned on by the manufacturer and is not something most people need to touch.

ESS affects external devices: when it is on, external fingerprint readers and external cameras may not be usable for Windows Hello, since they cannot meet its security requirements. Recent versions of Windows 11 offer a setting in Sign-in options to allow external cameras or fingerprint readers on such PCs, at a lower security level. Turning off biometrics with Remove, policy or the service works on ESS PCs as described above.

Biometrics on a shared family PC

On a family PC, each person's account has its own biometric enrollment, and one person's fingerprint never unlocks another person's account. That makes biometrics a good fit for families where each person has their own account: parents and children can each sign in with a touch, without sharing passwords.

Problems arise when accounts are shared, or when children try to enroll a parent's finger on their own account while the parent is not watching, which needs the account's PIN, so a child who knows the parent's PIN can do it. Keeping PINs private is the real safeguard. For younger children, a family-managed Microsoft account adds parental controls, and a simple rule, that nobody enrolls anyone else's finger or face, covers the rest.

If you prefer that nobody in the house uses biometrics on a particular PC, the registry or policy method blocks it for all accounts at once, and nobody can turn it back on without an administrator account. That is what Ethan did on the family desktop in the living room, while keeping fingerprint sign-in on his own laptop.

Lock the PC faster instead

Many people who consider turning off biometrics actually want something slightly different: to make sure the PC is locked when they are not at it. Windows has several tools for that, and they work alongside biometrics.

Press Windows + L whenever you step away; it locks instantly. In Settings, System, Power & battery, shorten the time before the screen turns off and the PC sleeps, and in Accounts, Sign-in options, set If you've been away, when should Windows require you to sign in again to Every time. Dynamic lock, in the same Sign-in options page, locks the PC automatically shortly after your paired phone moves out of Bluetooth range. Some PCs with presence sensors can lock when you walk away and wake when you return, configured under Privacy & security, Presence sensing, or a similar page, depending on the model.

Combined, these mean that someone reaching your PC finds it locked, and the fingerprint reader only works for a finger they would need you, awake, to provide. For Ethan, faster locking solved the sofa problem more completely than removing his fingerprint ever could.

Check whether someone signed in to your PC

If, like Ethan, you suspect someone has been signing in with your fingerprint or face, Windows keeps a record. Open Event Viewer by pressing Windows + R and running eventvwr.msc, then go to Windows Logs, Security. Successful sign-ins appear as events with ID 4624, and unlocks of a locked session are recorded too, each with a date and time. Matching those times to when you were away or asleep tells you whether the PC was unlocked without you.

The Security log is detailed and can be overwhelming; filter it by event ID with Filter Current Log on the right to show only sign-ins. The log does not usually say whether a fingerprint, face or PIN was used, but unexpected sign-in times are clue enough. If you find them, remove biometrics, change your PIN, and lock the PC more promptly, and if the situation is serious, talk to the person involved or seek appropriate help.

Before selling or giving away a PC

When a PC leaves your hands, all personal data should go with you, including biometric templates. The thorough way is Reset this PC, in Settings, System, Recovery, choosing Remove everything, and on drives that support it, the option to clean the drive. That deletes accounts, files, apps and biometric data together, and returns Windows to a fresh state for the next owner.

If you are only removing your account from a PC that someone else will keep using, remove your fingerprint and face in Sign-in options first, then delete your account from Settings, Accounts, Other users while signed in as another administrator. Removing the account deletes its files, but removing the biometric enrollment explicitly first is a good habit.

Work and school PCs: Windows Hello for Business

On PCs managed by an employer or school, biometrics are usually part of Windows Hello for Business, set up and controlled by IT through Intune or Group Policy. You may be required to set up a PIN, and biometrics may be allowed, required or blocked by policy. If the Remove button is grayed out or fingerprint options are missing, a policy is in control.

You can usually remove your own biometric enrollment if biometrics are optional, but you should not change policies, the biometric service or devices on a work PC. If you have concerns about biometric sign-in at work, ask IT about the options; many organizations allow PIN-only sign-in on request, and some have formal policies on biometric data that your HR or privacy team can explain.

For IT: managing biometrics across many PCs

Organizations rarely set biometrics PC by PC. In an Active Directory domain, the Biometrics policies described above are deployed through Group Policy objects linked to the right organizational units, so that, for example, shared kiosks block biometrics while staff laptops allow them. In Microsoft Intune, Windows Hello for Business settings, including whether biometrics may be used, are configured in identity protection or settings catalog profiles assigned to device groups.

Whatever the tool, a few practices help. Decide explicitly whether biometrics are allowed, rather than leaving the default, and document why. If biometrics are allowed, consider requiring enhanced anti-spoofing for face sign-in, and prefer devices with Enhanced Sign-in Security. Communicate clearly to staff that biometric templates stay on the device and are not collected centrally, since that is the most common concern, and offer PIN-only sign-in to anyone who prefers it, where policy allows.

For audits, sign-in events in the Windows Security log show when users sign in, and management tools report Windows Hello enrollment status, which helps confirm that a policy to disable biometrics has taken effect across the fleet.

Turn biometrics back on

To use fingerprint or face sign-in again, reverse whichever method you used. If you removed your enrollment, go to Settings, Accounts, Sign-in options, select the method, and choose Set up; follow the prompts to scan your finger several times or look at the camera. If you disabled the policy, set it to Not Configured, or delete the registry value, and restart. If you disabled the service, set it back to its original startup type and restart. If you disabled the device, enable it in Device Manager or firmware.

If the Set up button is grayed out or the method says it is unavailable after re-enabling, restart once more, check Windows Update for driver updates, and check Device Manager for errors on the biometric device. A fingerprint reader that worked before but now shows "We couldn't find a fingerprint scanner compatible with Windows Hello" usually needs its driver reinstalled from the PC maker's support site.

Which method should you use? A quick guide

If you simply do not want your own fingerprint or face used any more, use Remove in Sign-in options; nothing else is needed. If you want face sign-in to stay but not unlock the instant you sit down, turn off automatic lock screen dismissal. If you manage a shared, family or office PC and want nobody to use biometrics, set the policy, through Group Policy on Pro or the registry on Home. If a sensor is faulty and keeps prompting, disable the device. And if the PC is leaving your hands, reset it.

Whichever you choose, keep a strong, private PIN, lock the PC when you step away, and remember that your biometric data never left the PC in the first place.

Biometrics, security and privacy: should you turn them off?

For most people, biometrics are both convenient and secure. Your fingerprint or face is checked locally, cannot be phished like a password, and is protected against photos and simple fakes on Windows Hello-certified hardware. Paired with a PIN that only works on that device, they make PC sign-in far safer than a typed password.

The real weaknesses are physical and social: someone with access to your sleeping body, as Ethan's son demonstrated; a legal or workplace situation where you could be compelled to unlock a device with your finger or face more easily than with a PIN you know; or a shared household where you simply prefer that only typed credentials work. If any of those apply, turning biometrics off, or using them only for less sensitive accounts, is reasonable.

A middle path is common: keep biometrics, but lock the PC promptly with Windows + L, shorten the time before the screen locks, and turn off automatic lock screen dismissal for face recognition. Our guide to account lockout policy covers limiting guessing attempts on the PIN and password, which complements biometrics well.

Biometrics and accessibility

For some people, biometrics are not just convenient but important. Face recognition lets people with limited hand mobility sign in without typing, and fingerprint sign-in helps people who find remembering or entering a PIN difficult. Before disabling biometrics on a shared or family PC, consider whether anyone relies on them in this way; a policy that disables biometrics for everyone affects them most.

Where some users need biometrics and others prefer not to use them, leaving the feature available and letting each person decide, by enrolling or not, is usually the better approach. Windows also offers other accessible sign-in aids, such as the on-screen keyboard on the sign-in screen, which can help when biometrics are not available.

Biometrics and passwordless Microsoft accounts

Microsoft accounts can be made passwordless, where you sign in with Windows Hello, the Microsoft Authenticator app or a security key instead of a password. Windows 11 also has a setting in Sign-in options, For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, which hides the password option on the sign-in screen.

With either in place, Windows Hello becomes your main way in, and if you turn off biometrics, the PIN carries that role. Make sure you know your PIN before removing biometrics on such a PC, and that you have a recovery method for your Microsoft account, such as the Authenticator app or a recovery email, in case the PIN is ever forgotten. If you turn that setting off, the password option returns to the sign-in screen alongside the PIN.

Fingerprint or face not working? Fix before disabling

Some people disable biometrics because they stopped working reliably, when a quick fix would restore them. If fingerprint or face sign-in suddenly fails, try these first. Remove the enrollment and set it up again, which refreshes the templates and often fixes recognition problems. Clean the fingerprint sensor or the camera window gently, since dirt, scratches and screen protectors affect them. For fingerprints, enroll the same finger in different positions during setup, and consider adding a second finger.

If Windows says it cannot find a compatible sensor, check Device Manager for errors under Biometric devices, reinstall the driver from the PC maker's support site, and install Windows updates. A recent Windows or driver update sometimes breaks a sensor temporarily, with fixes following in later updates. If your PIN is also failing, fix that first, since biometrics depend on it.

If, after all that, the sensor remains unreliable, disabling it in Device Manager stops the repeated prompts, and signing in with a PIN is perfectly secure.

Frequently asked questions

Turning off biometrics in Windows takes ten seconds for your own account: Settings, Accounts, Sign-in options, Remove. For everyone on a PC, the Allow the use of biometrics policy, or its registry equivalent on Home, blocks the feature completely, while the service and Device Manager switches turn off the machinery itself. Your biometric data never leaves the PC, Remove deletes it, and the PIN carries on for sign-in and passkeys. Ethan's laptop now recognizes only one finger, and his son has gone back to asking politely.

Revision note. Written October 3, 2026, expanding our 2016 guide to disabling biometrics into a complete guide for Windows 11 and 10. It covers removing fingerprint and face sign-in, Group Policy, the registry, the Windows Biometric Service, disabling hardware, where biometric data is stored, the PIN and passkeys, Enhanced Sign-in Security, work PCs, turning biometrics back on, and whether to turn them off. May your PC open only for the people you choose.