Finger print login not working after last Windows updates

[SvenC]

After the latest Windows Updates two days ago I cannot login with my finger print reader any more and I found this KB article:

 

KB5005408: Smart card authentication might cause print and scan failures (microsoft.com)

 

Could that be the cause, that my finger print reader is not compliant anymore?

 

I removed and added finger prints, no change, reset my PIN, no change.

 

After I scan my finger, there is a short flicker and than I always get "This option is temporarily not available. Please use a different..." (translated from german, so maybe not exactly the english wording).

 

I think I have the none FIPS version, but not really sure. In device manager I see "Control Vault w/ Fingerprint Touch Sensor" from broadcom.

 

Is there any tool to check for hardware and software compliance of the scanner and its driver? The driver shows 5.9.3.1 from 16.12.2021

[heikkuri]

I have used Windows Hello PIN and last 12 months Hello Face with my 7550. I just used 1st time the Hello Fingerprint reader. It's works also OK.

PC has the latest Windows 10 OS Build 19044.1826.

Device Manager shows Control Vault version 5.9.7.16, date 31 Jan 2022. This is the Dell package A20.

File name Dell-ControlVault3-Driver-and-Firmware_88J36_WIN_5.9.8.17_A20.EXE

 

 Version 5.9.8.17, A20
 ------------------------

 Release date 02 Mar 2022

 Fixes & Enhancements
 - Fixed the issue where the contacted smartcard cannot be detected after the system resumes from Modern Standby.

[Aaron44126]

I can confirm that the fingerprint scanner is working as expected for me after the latest Windows Update patch from Tuesday.

Two systems: Precision M6700 (FIPS) and Precision 7560 (non-FIPS).  Both running Windows 10 Enterprise LTSC 2021 (19044.1826).

 

FIPS is a separate gold square in the palmrest on all models.  Non-FIPS will either be a "swipe" style reader in the palmrest, or integrated into the power button.

 

...Is your Precision system attached to an Active Directory domain?  Do you use a SmartCard?  (If not, I do not think that the Microsoft article really applies.)

 

It looks like the English language for this statement is "This option is currently unavailable."  This might help you with Googling for a solution.  I saw some articles like this which discuss resetting various things, checking group policy, etc.  https://supertechman.com.au/how-to-fix-windows-hello-this-option-is-currently-unavailable/

[SvenC]

Mine is a golden square in the palm rest. So maybe FIPS - but it works fast. I read that FIPS tends to be slow.

 

Yes the laptop is domain joined - hybrid domain with local DCs and an AzureAD.

 

Not using a smart card. Just thought that the finger print reader might fall into that category of security devices.

 

The error message I stated is not from the settings page, where you set up the finger prints. That is working. I can remove and add finger prints. Just when I (try to) use if for login, I get the error message, that this option is currently or temporarily not available.

 

I reset my PIN (an option I was given when login with PIN failed) again.

 

No I get "You credential could not be verified" for both PIN and finger print login attempts.

 

Hmm...

[SvenC]

The error message I get seems to depend on the company network: at home I get "Your credentials could not be verified". When I connect to the corp network with a VPN connection I get "This option is temporarily (or currently) not available."

 

So it seems to be some sort of communication with our company domain which fails.

[Aaron44126]

I can say that my Precision 7560 is also domain-joined and I haven't experienced this issue with the latest Windows patch.

 

...Have you tried just disabling all of the Windows Hello stuff and then turning it on again?  (I.e. remove the PIN and then set up a new one.)  I figure it has to "cache" your AD credentials somehow (password hash gets sent in to authenticate you when you login in with your fingerprint or PIN) so maybe something got messed up with that.

[SvenC]

I cannot disable Windows Hello from the settings page. Maybe forced by a group policy?

[heikkuri]

I have also AD joined company PC. When you change your PIN your have to wait 30 minutes before using new the PIN. If at home better have VPN active during this time. 

 

If working remotely how about to going back to office and connect PC to company network. It may resolve credential cache problems.

 

I had few times PIN and Face problems after changing my AD password. But next day it worked again. During that time I used my new AD password.

 

What kind of VPN software do you have?

 

If a company PC maybe better contact your IT support if you have this kind of service available.

 

[SvenC]

Between my first PIN change in the office and next usage from home several hours went by. I'll try that again on monday. But I think there should have been more than 30 minutes after the PIN reset and several tried to use the finger print reader.

 

We switched from OpenVPN to FortiClient VPN two weaks ago. But I never needed a VPN connection to use my finger print from my home.

 

The IT department had no idea what the reason could be 😉

[heikkuri]

30 min is just the wait time after change PIN etc. can be used first time. After this everything works with or without VPN.

Same also if you are at office. Wait 30 min before use your new PIN code.

[SvenC]

Even stranger: I wanted to check the event log entries of one of our DCs and mstsc asked me for my fingerprint before I could logon to the server with user/pwd. That fingerprint check succeeded. Login to my laptop by fingerprint still fails.

 

Hmm...

 

I am waiting for a new SSD (Crucial P3 Pro 4TB) and will setup Windows 11 from scratch and check if the problem remains.