How to Disable Biometrics in Windows 11 & 10 (All Easy)
—
The fastest way to disable biometrics in Windows 11 or Windows 10 is to open Settings, go to Accounts > Sign-in options, and remove your enrolled fingerprint or face under Windows Hello — that stops your own prompt in under a minute. But removing your enrollment does not switch off the fingerprint reader itself. Windows Biometric Service keeps running underneath the whole time, and anyone else who sits down at that PC can enroll their own finger, unless you also stop that service or set the policy that blocks biometrics account-wide. That's the part almost nobody mentions, and it's the reason a lot of "disabled" fingerprint readers aren't actually disabled at all.
Not every "disable biometrics" question is the same question. Someone asking this has usually landed on one of three different problems, and each needs a different fix: their own fingerprint prompt gone, the reader dead for every account on a shared machine, or a policy that stops it from being turned back on. Mixing those up is why so many fixes online don't hold.
🙋♂️ Jake's Reality Check
"One of my part-time guys enrolled his thumbprint on the shop's trade-in laptop before he quit. I went into Settings and removed his fingerprint, but he still got in two days later while I was at lunch — cost me about $150 in a trade-in he processed on his own. Did I break something?"
You didn't break anything — you fixed the wrong layer. Removing a fingerprint in Settings only removes that person's enrollment from their own account. It doesn't touch the reader or the service that lets anyone re-enroll. The fix for a shared shop machine isn't "remove the fingerprint," it's "turn off the reader" — which we'll get to next.
We'll walk through Windows 11 first, since that's what most machines sold recently are running, then do the same job on Windows 10, which is still on a huge share of PCs. The steps for stopping the service and setting the policy are identical on both — we'll say so once and not repeat it.
Windows 11: turn off your own fingerprint or face sign-in
This is the one-account fix. It's the right starting point if the PC is yours alone and you just don't want to be prompted anymore.
Step by step
Press Win + I to open Settings, then go to Accounts, then Sign-in options. Under Windows Hello — Microsoft's umbrella name for face, fingerprint, and PIN sign-in, not a separate app — you'll see Fingerprint recognition and, on devices with a compatible camera, Facial recognition. Click into whichever is set up and choose Remove, confirming with your PIN or password.
If the laptop has both a fingerprint reader and a face camera, removing one does not remove the other — they're separate enrollments. Repeat for each one you want gone.
If there's nothing to remove
If the tile already shows "Not set up" but a prompt is still appearing, it's coming from a different account on the same PC — a family member's profile, a leftover work account, or a guest sign-in. Check Settings > Accounts > Family & other users for who else has a profile, or move straight to the whole-machine fix below.
Windows 11: shut off the biometric service so no one can enroll
This is the one that holds on a shared machine. Instead of removing one person's enrollment, it turns off the service that powers every fingerprint and face reader on the PC, for every account.
Step by step
Press Win + R to open the Run box, type services.msc, and press Enter. That opens the Services console — a list of every background program Windows runs whether or not you ever see it. Find Windows Biometric Service, right-click, choose Properties, click Stop, then change Startup type to Disabled, and click Apply > OK.
Disabled, not just stopped, matters. A stopped service still set to Manual will start itself again the moment anything tries to use it.
✅ Why this is the one to use
"Removing a fingerprint just erases one entry," Ethan told Jake. "Anyone can add their own back in thirty seconds. Stopping the service is the only one of these that actually takes the reader off the table for everybody, until someone with admin rights turns it back on."
Windows 11 Pro, Enterprise, Education: the domain policy from our original guide
Stopping the service works, but it's a switch anyone with admin rights can flip back. On a domain-joined PC, the setting we originally covered back in 2016 is still there and still does the job: it stops biometric sign-in for domain accounts specifically, as a matter of policy rather than a switch that can be casually re-flipped.
Step by step
Win + R, type gpedit.msc, Enter — this opens the Local Group Policy Editor, the same kind of tool a company's IT department uses domain-wide, aimed here at just the one machine. Go to Computer Configuration > Administrative Templates, then All Settings in the right pane, and search for Allow domain users to log on using biometrics. Select it, choose Disabled, then Apply > OK.
⚠️ What this actually breaks
If this PC belongs to an employer, IT's own Group Policy refreshes on a schedule and can overwrite a local change like this one the next time it syncs. If the setting keeps reverting, that's not a bug — it means the policy is coming from the domain, and the request needs to go to IT, not gpedit on the machine itself.
Windows 11 Home: why Group Policy was never the tool for you
Home doesn't include gpedit.msc — opening it just gives you a "Windows cannot find gpedit.msc" error, which is expected, not a sign anything's broken. But that setting was never going to help a Home PC anyway: Home can't join a company domain in the first place, and the policy above only governs domain accounts. There's nothing for it to switch off on a Home machine.
The real substitute for Home is the fix from the previous section: stopping Windows Biometric Service. It blocks the reader for every account, domain or not, and it's the same three clicks on Home as on Pro.
🕐 What changed since we first wrote this
- Then: our 2016 guide covered two routes — stopping the biometric service, and the domain-only Group Policy setting — because that was the whole toolkit at the time.
- Now: Windows has since added a Settings-app path that lets you remove just your own enrollment, without touching the service or the domain policy at all.
- What that means for you: the domain policy from our original guide still works exactly as described, but it's no longer the only option if the PC isn't on a company domain.
Windows 10: the same routes, same menus
Every method above works identically on Windows 10: Settings > Accounts > Sign-in options to remove your own enrollment; Win + R > services.msc > Windows Biometric Service to block it for everyone; Win + R > gpedit.msc > Computer Configuration > Administrative Templates > All Settings > the same domain policy on Pro, Enterprise, and Education. Home follows the same logic as Windows 11 Home above — no domain join, so stopping the service is the real answer.
🙋♂️ Jake's Reality Check
"Is any of this different because Windows 10 stopped getting updates? I don't want to fuss with a setting that doesn't matter anymore."
No, and that's worth knowing. Windows 10 22H2 reached the end of free security updates on October 14, 2025. It still boots, still runs, still enrolls fingerprints exactly as before — support ending doesn't switch anything off. If this machine is still handling day-to-day work, Consumer Extended Security Updates is still open for enrollment, now covering devices through October 2027 after Microsoft extended the program an extra year. That's a separate decision from biometrics, but it's the honest context if you're still on Windows 10.
Which method actually fits your situation
| Method | Works on Home? | Use it when |
|---|---|---|
| Remove enrollment (Settings) | Yes | It's your own PC and your own prompt. |
| Stop the biometric service | Yes | A shared or shop machine where anyone could re-enroll. |
| Group Policy (gpedit.msc) | No — and moot, since Home can't join a domain | Domain-joined Pro/Enterprise/Education, blocking domain accounts specifically. |
When it doesn't stick
The prompt keeps coming back after you removed it in Settings
This almost never means the removal failed. It means a different account on the PC still has a fingerprint enrolled — check Family & other users, or move up to stopping the service.
The service switches itself back on
On a domain-joined PC, this is almost always Group Policy from the domain controller reasserting itself on its next refresh — the local Services change is being overwritten from above, and re-disabling it locally won't hold. On a personal, non-domain PC, a major Windows update can occasionally reset service states during install; if that's the pattern, redo it once after any big update rather than fighting it repeatedly.
Group Policy doesn't seem to apply
Local policy changes sometimes need a restart, or a sign-out and back in, to take hold immediately. Give it that before assuming the setting itself is broken.
Laptops, external readers, and shared machines
Built-in laptop readers vs. plug-in USB readers. Everything above applies the same way to a reader built into the laptop's power button or trackpad and to a separate USB fingerprint dongle. One difference: if the reader is a removable USB accessory, unplugging it is itself a valid disable for that specific device — though it won't stop a different, built-in reader on the same PC from still working.
Tablets and 2-in-1s with only a face camera. Same steps, just the Facial recognition entry instead of Fingerprint recognition.
Multiple people, one PC. The single most common version of this problem, per Jake's shop, isn't a broken reader — it's an ex-employee, a former partner, or a customer's device that still has an enrollment nobody remembered to remove. Stopping the service is the fastest way to be sure the account list doesn't matter anymore.
Doing this across more than one PC
Clicking through Services on one PC is nothing. Doing it on six shop machines every time a part-timer's shift ends is where it stops being worth the time. "Doing it on six machines every time someone's shift ends is where it stops being worth your time," Ethan said. "That's when it's worth asking whoever runs the domain to push the policy out instead." If more than a couple of PCs on an actual company domain need this, the same Group Policy setting from the section above can be pushed to every domain machine at once, rather than set locally on each.
Frequently asked questions
Does removing my fingerprint delete it from my account?
Yes, for that account. Windows removes the enrollment tied to that sign-in immediately, and nothing is left behind for that user to be re-detected on that PC.
Why does the fingerprint reader still show up in Device Manager after I disable it?
Disabling the service or an enrollment doesn't remove the physical hardware from Windows' device list — it just stops Windows from letting anything use it for sign-in. Seeing it listed is normal.
Can I disable biometrics for just one user and leave it on for another?
Yes — that's exactly what the Settings removal does. It only affects the signed-in account; every other account keeps its enrollment until you repeat the removal there too.
Will this affect a work-managed sign-in requirement?
If the PC is domain-joined, IT's own policy may already be managing this, and a local change can be overwritten on the next refresh. Anything about a work sign-in requirement is a conversation for IT.
Does Windows 10's end of support affect biometric sign-in?
No. The end of free security updates on October 14, 2025 didn't change any existing feature — fingerprint and face sign-in keep working exactly as before.
Why does this guide recommend stopping the service instead of just removing my fingerprint on a shared PC?
Because removing an enrollment only closes the door on one account. Stopping the service is the only method above that stops a new person from opening a new door of their own.
Why doesn't gpedit.msc exist on my PC?
The Local Group Policy Editor ships only with Windows Pro, Enterprise, and Education. Home doesn't include it at all.
Even if I could open gpedit on Home, would the domain policy do anything?
No. Home editions can't join a company domain in the first place, and this particular policy only governs domain accounts. There's nothing on a Home PC for it to affect.
Can someone bypass a disabled fingerprint reader and still get in?
Not through the reader once the service is off — but this was never meant to substitute for a strong password or PIN on the accounts themselves. If someone knows the password, biometrics being on or off was never the barrier.
Why did the Group Policy setting stop working after a few hours?
On a domain-joined PC, that's almost always the domain's own policy reasserting itself on its next refresh. It needs to be changed at the domain level, not locally.
My Group Policy change didn't apply immediately — what should I do?
Sign out and back in, or restart. Local policy changes don't always take effect the instant you click OK.
Can I turn biometrics back on later?
Yes. Set the service back to Manual or Automatic and start it, or flip the Group Policy setting back to Not Configured, then re-enroll your fingerprint or face in Settings.
Revision note. Originally published July 13, 2016. Rewritten August 16, 2026 for Windows 11 and Windows 10. The domain policy from our original guide still works exactly as described back then; what's changed is that Windows now also lets you remove just your own fingerprint from Settings, without touching the service or the domain policy at all. Whichever version of this problem brought you here, we hope this gets you back in control of it without a fight.