Strengthen Your Windows 11 Security: Enabling Enhanced Sign-in Security (ESS)

Table of Contents

Enhanced Sign-in Security (ESS) in Windows 11 provides an elevated level of protection for your biometric authentication methods. This feature bolsters the security of facial recognition and fingerprint sensors by creating a secure communication channel for your biometric data. By enabling ESS, you are adding a crucial layer of defense against potential threats that could target your sign-in credentials. This enhanced security is particularly relevant in today’s digital landscape where data protection is paramount.

Understanding Enhanced Sign-in Security (ESS)¶

Enhanced Sign-in Security (ESS) is not merely an alternative sign-in method; it’s an augmentation of the existing Windows Hello framework. It functions by establishing a secure tunnel for communication between your biometric sensors and the operating system. This secure channel is achieved through virtualization-based security (VBS), a foundational security feature in modern Windows versions. In essence, ESS ensures that the sensitive biometric data used for authentication is isolated and protected from malicious software or attacks that might attempt to intercept or compromise it. Think of it as an armored transport for your fingerprint or facial scan data, ensuring its safe journey during the login process.

ESS is designed to work specifically with biometric sensors, such as facial recognition cameras and fingerprint readers. It doesn’t apply to traditional passwords or PINs. The primary goal of ESS is to mitigate risks associated with biometric authentication, making it a more robust and trustworthy security option. By leveraging hardware and software virtualization, ESS creates a more secure environment for handling your personal biometric information during the sign-in process.

Hardware Prerequisites for Enhanced Sign-in Security¶

To utilize Enhanced Sign-in Security, your Windows 11 system must meet specific hardware requirements. These requirements are in place to ensure that the necessary security foundations are present for ESS to function correctly and effectively. Without these hardware components, the enhanced security features of ESS cannot be fully realized.

Here’s a breakdown of the essential hardware requirements:

• Virtualization-Based Security (VBS): VBS is the bedrock upon which ESS is built. It utilizes hardware virtualization to create an isolated secure environment within the operating system. This isolation is crucial for protecting sensitive processes and data from the rest of the system, including potential malware. VBS must be enabled in your system’s BIOS/UEFI settings and supported by your processor.

• Trusted Platform Module (TPM) 2.0: TPM 2.0 is a hardware security module that provides cryptographic functions. It is used by ESS to securely store and manage cryptographic keys, which are essential for establishing the secure communication channel. TPM 2.0 enhances the overall security posture of the system and is a mandatory component for ESS.

• Device Guard Enablement: Device Guard is a suite of security features in Windows that helps protect against malware and other threats. For ESS, Device Guard needs to be enabled. It works in conjunction with VBS to further harden the system and ensure a secure environment for biometric authentication. Device Guard helps to ensure that only trusted code is allowed to run on the system.

• ESS Supported Biometric Sensors and Drivers: Not all biometric sensors are inherently compatible with ESS. You need to have biometric sensors and drivers that are specifically designed to support Enhanced Sign-in Security. Check with your hardware manufacturer to confirm if your fingerprint reader or facial recognition camera supports ESS. Ensure you have the latest drivers installed for these devices to guarantee compatibility.

• Secure Devices (SDEV) ACPI Table Configured Device Firmware: The firmware of your device, specifically the ACPI (Advanced Configuration and Power Interface) table, must be configured by the hardware manufacturer to support Secure Devices (SDEV). This configuration is necessary for the operating system to properly recognize and utilize the security capabilities of the biometric hardware in conjunction with ESS. This is generally handled by the device manufacturer and is not something users typically configure directly.

Enabling Enhanced Sign-in Security (ESS) via Windows Settings¶

The most straightforward method to enable Enhanced Sign-in Security in Windows 11 is through the Windows Settings application. This graphical interface provides a user-friendly way to toggle ESS on or off. Follow these steps to enable ESS:

1. Open Windows Settings: The quickest way to access Windows Settings is by pressing the Windows key + I simultaneously. This keyboard shortcut will directly launch the Settings app. Alternatively, you can click on the Start button, then select the “Settings” icon (which looks like a gear).

2. Navigate to Accounts and then Sign-in options: In the Windows Settings window, locate and click on the “Accounts” category. Within the Accounts settings, find and select “Sign-in options” from the left-hand menu. This section manages various sign-in methods and security settings for your user account.

3. Access Additional settings: Scroll down the “Sign-in options” page until you find the “Additional settings” section. This section contains less frequently used, but important sign-in related configurations, including the setting for Enhanced Sign-in Security.

4. Locate “Sign in with an external camera or fingerprint reader”: Within “Additional settings,” you will find an option labeled “Sign in with an external camera or fingerprint reader.” This setting directly controls the Enhanced Sign-in Security feature for compatible biometric devices.

5. Toggle the switch to “On”: To enable ESS, click the toggle switch located next to “Sign in with an external camera or fingerprint reader.” When the toggle is switched to the right and appears in the “On” position (often indicated by a blue or highlighted color), Enhanced Sign-in Security is activated. Windows may prompt you to confirm the change or require administrator privileges to enable this feature.

After enabling ESS, it’s recommended to restart your computer to ensure the changes are fully applied and that the enhanced security features are active.

Disabling Enhanced Sign-in Security (ESS) via Windows Settings¶

If you need to disable Enhanced Sign-in Security for any reason, the process is just as simple as enabling it. You will use the same Windows Settings interface to turn it off.

1. Open Windows Settings: Press Windows key + I to open the Settings app.

2. Navigate to Accounts > Sign-in options: Go to the “Accounts” category and then select “Sign-in options.”

3. Access Additional settings: Scroll down to the “Additional settings” section.

4. Locate “Sign in with an external camera or fingerprint reader”: Find the same “Sign in with an external camera or fingerprint reader” option.

5. Toggle the switch to “Off”: Click the toggle switch to turn it to the “Off” position. When the toggle is switched to the left and appears in the “Off” position (often indicated by a gray or unhighlighted color), Enhanced Sign-in Security is deactivated.

Just like enabling ESS, it’s advisable to restart your computer after disabling it to ensure the changes are fully implemented.

Enabling/Disabling Enhanced Sign-in Security via Registry Editor¶

For users who prefer a more direct configuration method or need to manage ESS settings across multiple machines, the Registry Editor provides an alternative to the Windows Settings interface. Modifying the registry requires caution, so ensure you follow these steps carefully. Incorrect modifications can lead to system instability.

1. Open Registry Editor: Press Windows key + R to open the Run dialog box. Type regedit and press Enter. Click “Yes” if prompted by User Account Control to allow Registry Editor to make changes to your device.

2. Navigate to the WinBio Registry Key: In the Registry Editor window, navigate to the following path using the left-hand pane:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinBio
   

   You can copy and paste this path into the address bar of the Registry Editor for quick navigation.

3. Modify or Create the “SupportPeripheralsWithEnhancedSignInSecurity” DWORD Value: In the right-hand pane of the WinBio key, look for a DWORD (32-bit) Value named SupportPeripheralsWithEnhancedSignInSecurity.

   • If the DWORD value exists: Double-click on SupportPeripheralsWithEnhancedSignInSecurity to modify its value data.
   • If the DWORD value does not exist: Right-click in an empty space in the right-hand pane, select “New” > “DWORD (32-bit) Value.” Name the new value SupportPeripheralsWithEnhancedSignInSecurity.

4. Set the Value Data:

   • To Enable ESS: Set the “Value data” to 1. (Note: In the original article it says 0 to turn ON, but based on common registry logic and testing, 1 is often used to enable features in binary DWORD values).
   • To Disable ESS: Set the “Value data” to 0. (Note: In the original article it says 1 to turn OFF, and based on common registry logic and testing, 0 is often used to disable features in binary DWORD values).

   Select “Decimal” as the base and enter the corresponding value (1 or 0) in the “Value data” field. Click “OK” to save the changes.

5. Restart Your Computer: Close the Registry Editor and restart your computer for the changes to take effect.

Caution: Modifying the registry incorrectly can cause serious problems. Always back up your registry before making changes, or create a system restore point as a safety measure.

Verifying if Enhanced Sign-in Security is Enabled¶

After enabling Enhanced Sign-in Security, you can verify if it’s functioning correctly by using the Event Viewer. Event Viewer is a built-in Windows tool that logs system events, including those related to security and hardware.

1. Open Event Viewer: Type “Event Viewer” in the Windows search bar and select the Event Viewer app. Alternatively, right-click on the Start button, select “Event Viewer.”

2. Navigate to the Biometrics Operational Log: In the Event Viewer, expand “Applications and Services Logs” in the left-hand pane. Then, expand “Microsoft,” then “Windows,” and finally “Biometrics.” Within “Biometrics,” select “Operational.”

3. Look for Event ID 1108: In the “Operational” log, look for events with the Event ID 1108. You can use the “Filter Current Log” option in the right-hand pane to filter events by Event ID to quickly find Event ID 1108.

4. Event ID 1108 Confirmation: If you find Event ID 1108 in the Biometrics Operational log, it indicates that Enhanced Sign-in Security is successfully enabled and working on your system. The presence of this event signifies that the system has initialized and is utilizing ESS for biometric authentication.

5. Troubleshooting if Event ID 1108 is Not Found: If you do not see Event ID 1108, it could mean that ESS is not enabled or is not functioning correctly. In this case:

   • Double-check Hardware Requirements: Ensure your system meets all the hardware prerequisites for ESS (VBS, TPM 2.0, Device Guard, compatible sensors and drivers, SDEV ACPI table).
   • Verify ESS is Enabled in Settings/Registry: Confirm that you have enabled ESS through Windows Settings or the Registry Editor as described earlier.
   • Update Drivers: Ensure you have the latest drivers installed for your biometric sensors. Outdated drivers can sometimes cause compatibility issues with ESS.
   • Consult Hardware Manufacturer: If issues persist, check your hardware manufacturer’s website for specific information about ESS support for your device model, or contact their support for assistance.

Does Windows 11 Offer Enhanced Security Features?¶

Yes, Windows 11 is designed with a strong emphasis on security and incorporates several enhanced security features. Enhanced Sign-in Security (ESS) is just one of the components contributing to the overall improved security posture of Windows 11. Microsoft has integrated various security technologies to protect users from modern threats.

Beyond ESS, Windows 11 benefits from other security features such as:

• Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI): These features, which are prerequisites for ESS, provide a fundamental layer of protection by isolating critical system processes and ensuring code integrity.
• Windows Hello: While ESS enhances biometric sign-in, Windows Hello itself provides a more secure and convenient alternative to passwords, supporting facial recognition, fingerprint authentication, and PINs.
• Microsoft Defender Antivirus: The built-in antivirus solution is continuously updated to protect against malware, viruses, and other threats.
• SmartScreen: SmartScreen helps protect against phishing and malware websites and apps.
• Secure Boot: Secure Boot helps prevent malware from loading during the system startup process.

While Windows 11 provides a robust security foundation, it’s important to remember that security is a layered approach. Users should also practice good security habits, such as keeping their software updated, being cautious about suspicious links and attachments, and using strong, unique passwords where applicable (even with biometric sign-in enabled, passwords may still be used in certain scenarios).

How to Disable Enhanced Sign-in Security¶

As previously explained, you can disable Enhanced Sign-in Security through Windows Settings by toggling the “Sign in with an external camera or fingerprint reader” option to “Off,” or by modifying the SupportPeripheralsWithEnhancedSignInSecurity DWORD value in the Registry Editor to 0. Both methods effectively deactivate the enhanced security layer for biometric sign-in.

Disabling ESS might be necessary in specific situations, such as troubleshooting compatibility issues with certain applications or hardware, or if you prefer to temporarily or permanently revert to standard biometric sign-in security. However, for optimal security, it’s generally recommended to keep Enhanced Sign-in Security enabled if your system supports it and you are using biometric sign-in methods.

Do you have any experience enabling Enhanced Sign-in Security on your Windows 11 device? Share your thoughts and questions in the comments below!