Windows Hello For Business (WHfB)

For work-related Windows PCs managed by the IT Centre only

Windows Hello for Business (WHfB) enables users to log in to Windows PCs without a traditional password. Instead, they log in using a PIN or biometric features such as a fingerprint or facial recognition. WHfB enables a user-friendly, convenient and secure password-free login to Windows PCs and can also be used as an additional authentication factor for multi-factor authentication (MFA).

Security considerations

We recommend passwordless login because the login credentials are device-specific – that is, they are stored only on the respective device and protected by the Trusted Platform Module (TPM). This enhances security and offers significantly better protection against phishing and password theft than traditional passwords. Even if your PIN were to fall into the wrong hands, it cannot be used to log in to other devices, applications or web services, as it applies exclusively to the device on which it was set up. The same applies to biometric features.

JMU password

Even when logging in with a PIN or biometrics, you must still know your JMU password, as it is required in certain situations, e.g. as a fallback in the event of problems with the PIN or biometrics, to log in to (new) work PCs on which you have not yet set up WHfB, or for web applications that do not support password-free login.

Restrictions

• WHfB is only available on work Windows PCs managed by the IT Centre – not on personal Windows PCs, Macs or Linux systems – and only works for logging in with a personal user account.
• The PC must have the required hardware and an activated TPM 1.2 or 2.0 – which, however, applies to most current work Windows PCs. You can check TPM availability by pressing Windows + R → tpm.msc. The status should show ‘The TPM is ready for use’.