Interactive Troubleshooter

Published: Sep 12, 2026

Windows Hello Fingerprint Not Available After Update: Diagnostic & Repair Guide

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Comprehensive root-cause diagnostic tree for resolving missing or disabled Windows Hello fingerprint authentication after major Windows updates. Systematically resolves driver descriptor requests, corrupted NGC container databases, Windows Biometric Service (WBS) crashes, and enterprise Group Policy restrictions.

Full Diagnostic Tree & Step-by-Step Overview

What error message or state is displayed under Settings > Accounts > Sign-in options, or in Device Manager?

Sign-in options shows 'We couldn't find a fingerprint scanner compatible with Windows Hello Fingerprint'.
Sign-in options shows 'This option is currently unavailable' or greyed out due to organization/policy settings.
Fingerprint option is available, but scanning fails instantly with 'Something went wrong' or returns to the PIN prompt.
Device Manager shows a yellow warning triangle (Code 10, 28, or 43) under Biometric Devices or Unknown USB Device.

How is the Biometric hardware represented in Device Manager when 'Show hidden devices' is enabled?

Biometric Devices node is completely missing, and ACPI/USB controller shows a power management fault.
Biometric Devices node exists, but Windows update replaced vendor driver with 'Generic USB Class Driver'.
Biometric hardware is hidden or listed under Human Interface Devices (HID) as disabled.

Restoring Power State to Biometric Sensor in UEFI/BIOS and ACPI Bus

Solution:

Root Cause: UEFI/BIOS Biometric Security Gate or Selective Suspend Power Lock

Major Windows updates often trigger firmware-level hardware initialization changes. During feature updates, the System Management BIOS (SMBIOS) table may disable power delivery to the internal Inter-Integrated Circuit (I2C) or Universal Serial Bus (USB) header hosting the biometric sensor. Alternatively, Windows Selective Suspend may place the host controller into an unrecoverable D3 low-power state.

# Diagnostic Verification:

Open PowerShell as Administrator and run:

powershell
  Get-PnpDevice -Class Biometric -PresentOnly

If no devices return, query the ACPI bus status:

powershell
  Get-WmiObject Win32_PNPEntity | Where-Object {$_.PNPDeviceID -match "USB\\VID_" -and $_.ConfigManagerErrorCode -ne 0}

# Step-by-Step Fix:

1. Disable Fast Startup to Force Hard Hardware Enumeration:

Open Command Prompt (Admin) and run:

cmd
     powercfg /hibernate off

2. Re-enable Biometric Interface in UEFI/BIOS:

Reboot the computer and enter BIOS/UEFI setup (typically by pressing F2, F10, F12, or Del).

Navigate to Security > I/O Port Access or System Configuration > Biometric Device.

Explicitly set the fingerprint reader interface from Disabled or Auto to Enabled.

Save settings and exit (F10).

3. Re-enable USB Selective Suspend Settings:

Boot into Windows, open powercfg.cpl, click Change plan settings > Change advanced power settings.

Expand USB settings > USB selective suspend setting and set it to Disabled.

4. Force System Re-enumeration via Device Manager:

Open devmgmt.msc, right-click top node (PC Name), and select Scan for hardware changes.

# Prevention & Long-Term Monitoring:

Keep motherboard UEFI firmware updated directly from the vendor's official support portal to preserve ACPI table definitions post-update.

Rolling Back Incompatible Generic Drivers and Reinstalling OEM Biometric Stack

Solution:

Root Cause: Windows Update Overwriting OEM Hardware Abstraction Layer (HAL) Drivers

Feature updates regularly overwrite proprietary OEM fingerprint sensor drivers (such as Synaptics, Goodix, or Elan) with generic Microsoft WinUSB driver stubs. Generic drivers lack the specialized Secure Channel Protocol (SCP) or Windows Hello System Sensor Adapter interfaces needed to process encrypted biometric templates.

# Diagnostic Verification:

Open devmgmt.msc, expand Biometric Devices, right-click the sensor, and choose Properties.

Under the Driver tab, inspect the Driver Provider. If it reads Microsoft instead of the OEM vendor (e.g., Synaptics Incorporated), the driver stack has been degraded.

# Step-by-Step Fix:

1. Roll Back to Previous Working Driver:

In the device Properties window, click the Driver tab.

Select Roll Back Driver if available, choose a reason, and click Yes.

2. Completely Uninstall and Remove Incompatible Driver Store Package:

If Roll Back is unavailable, select Uninstall Device.

Check the option Attempt to remove the driver for this device (or *Delete the driver software for this device*) and click Uninstall.

3. Install Official OEM Biometric Package:

Download the latest driver package directly from your laptop manufacturer's site or consult the Microsoft Hardware Support Portal for driver installation requirements.

Install the package using elevated administrative permissions.

4. Prevent Windows Update from Overwriting Specific Device Driver:

Open gpedit.msc (or edit local policy).

Navigate to: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.

Enable Prevent installation of devices that match any of these device IDs and add the Hardware ID from Device Manager.

# Prevention & Long-Term Monitoring:

Pause driver updates via wushowhide.diagcab or Group Policy to stop Windows Update from overwriting functional biometric drivers.

Re-enabling Hidden HID Biometric Services and Clearing Ghost Drivers

Solution:

Root Cause: Hidden Ghost Devices and HID Driver State Desynchronization

During a system update, Windows may create orphaned ghost device nodes while assigning new Instance IDs to physical USB/I2C buses. The fingerprint reader gets trapped as an inactive Human Interface Device (HID) component, preventing the Windows Biometric Framework (WBF) from initializing the sensor abstraction layer.

# Diagnostic Verification:

Open Command Prompt as Administrator and run:

cmd
  set devmgr_show_nonpresent_devices=1
  start devmgmt.msc

Click View > Show hidden devices. Look for faded/translucent entries under Biometric Devices or Human Interface Devices.

# Step-by-Step Fix:

1. Remove Faded Ghost Devices:

In Device Manager, locate all translucent/greyed-out biometric or fingerprint reader entries.

Right-click each ghost device and select Uninstall device.

2. Restart the Windows Biometric Service (WbioSvc):

Open Admin PowerShell and execute:

powershell
     Stop-Service -Name WbioSvc -Force
     Start-Service -Name WbioSvc

3. Reset Human Interface Device Service Dependencies:

Ensure dependent services are operational:

powershell
     Set-Service -Name hidserv -StartupType Automatic
     Start-Service -Name hidserv

4. Re-scan for Hardware Changes:

In Device Manager, click Action > Scan for hardware changes to force clean driver binding.

# Prevention & Long-Term Monitoring:

Run a system cleanup after major Windows upgrades to purge obsolete device driver packages from the DriverStore repository.

What type of account environment or policy message is present on the machine?

Local standalone or non-domain user account affected by system Group Policy override.
Active Directory or Microsoft Entra ID (Azure AD) account with disabled Convenience PIN/Biometrics.

Re-enabling Windows Biometric Framework Policies in Group Policy and Registry

Solution:

Root Cause: Local Group Policy or Registry Key Disabling Windows Hello

Windows updates can inadvertently reset or re-enforce administrative policies governing biometric sign-in credentials. If the AllowDomainPINLogon or AllowBiometrics keys are disabled or set to 0 in the Local Machine policy registry hive, Windows Hello options immediately present as 'unavailable'.

# Diagnostic Verification:

Query the active Registry biometric policy keys via PowerShell:

powershell
  Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPINLogon" -ErrorAction SilentlyContinue
  Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WinBio\Engine" -Name "Enabled" -ErrorAction SilentlyContinue

# Step-by-Step Fix:

1. Configure Local Group Policy Editor:

Press Win + R, type gpedit.msc, and press Enter.

Navigate to: Computer Configuration > Administrative Templates > Windows Components > Biometrics.

Double-click Allow the use of biometrics and set it to Enabled.

Double-click Allow users to log on using biometrics and set it to Enabled.

2. Enable Convenience PIN Sign-in Policy:

Navigate to: Computer Configuration > Administrative Templates > System > Logon.

Double-click Turn on convenience PIN sign-in and set it to Enabled.

3. Force Policy Registry Override via PowerShell:

Run Admin PowerShell to enforce key states:

powershell
     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WinBio" -Force | Out-Null
     Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WinBio" -Name "Enabled" -Value 1 -Type DWord
     Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPINLogon" -Value 1 -Type DWord

4. Force Immediate Group Policy Update:

Run gpupdate /force in Command Prompt, then restart the system.

# Prevention & Long-Term Monitoring:

Verify third-party system optimization or privacy software is not automatically applying hardened privacy templates that turn off biometrics.

Configuring Entra ID / Active Directory Tenant Credentials for PassportBiometrics

Solution:

Root Cause: Tenant-Level Windows Hello for Business (WHfB) Policy Enforcement

When a Windows system updates while joined to Microsoft Entra ID (formerly Azure AD) or a hybrid Active Directory domain, MDM enrollment policies (Intune) may push an updated PassportForWork configuration profile. If biometric authentication (PassportBiometrics) is restricted or disabled at the organization level, local Windows Hello controls are blocked.

# Diagnostic Verification:

Open Command Prompt and inspect Windows Hello for Business diagnostic state:

cmd
  dsregcmd /status

Under SSO State and User State, check if NgcSet : YES and CanReset : YES. Under Device Output, confirm IsDeviceJoined : YES.

# Step-by-Step Fix:

1. Modify Registry Keys for Enterprise Windows Hello Support:

Open PowerShell as Administrator and execute:

powershell
     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Force | Out-Null
     Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Name "Enabled" -Value 1 -Type DWord
     Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -Name "UseBiometrics" -Value 1 -Type DWord

2. Re-sync Intune / MDM Management Policies:

Open Settings > Accounts > Access work or school.

Select your company account, click Info, and click Sync.

3. Clear Stale Passport Provider State:

Run elevated command to re-trigger WHfB enrollment context:

cmd
     certutil /setreg chain\EnableWeakSignatureFlags 8

4. Sign out and log back in using domain credentials to complete biometrics enrollment.

# Prevention & Long-Term Monitoring:

System administrators should ensure Intune Configuration Profiles explicitly set 'Use Biometrics' to 'Enabled' in the Windows Hello for Business settings catalog.

What happens when you attempt to delete the existing fingerprint template or reset Windows Hello?

Clicking 'Remove' or 'Set up' causes Settings app to crash or throw an unexpected error.
Scanner reads finger during setup, but fails at the final step when assigning a PIN.

Purging Corrupted WinBioDatabase and Windows Biometric Service Store

Solution:

Root Cause: Windows Biometric Framework Database Corruption

Windows stores enrolled biometric template hashes in an encrypted local database located under C:\Windows\System32\WinBioDatabase. When feature updates alter security encryption keys or crash during logoff initialization, .DAT database files can become corrupted. The Windows Biometric Service (WbioSvc) fails to read or overwrite corrupted database slots, causing crashes in the Settings app.

# Diagnostic Verification:

Inspect Event Viewer under Applications and Services Logs > Microsoft > Windows > Biometrics > Operational.

Look for Event ID 1001 or 1002 indicating database read/write failures.

# Step-by-Step Fix:

1. Stop the Windows Biometric Service (WbioSvc):

Open Admin PowerShell and run:

powershell
     Stop-Service -Name WbioSvc -Force

2. Backup and Clear WinBioDatabase Directory:

Execute the following commands in PowerShell:

powershell
     $DbPath = "$env:SystemRoot\System32\WinBioDatabase"
     Copy-Item -Path "$DbPath\*.DAT" -Destination "$env:TEMP\WinBioBackup" -Force
     Remove-Item -Path "$DbPath\*.DAT" -Force

3. Restart Biometric Service to Re-create Clean Database Files:

Run:

powershell
     Start-Service -Name WbioSvc

4. Re-enroll Fingerprint Biometrics:

Open Settings > Accounts > Sign-in options > Windows Hello Fingerprint.

Click Set up and follow prompts to record fresh fingerprint templates.

# Prevention & Long-Term Monitoring:

Always remove and re-enroll fingerprint biometrics prior to initiating major Windows build upgrades.

Clearing Corrupted NGC Keys Container and Rebuilding TPM Key Enclave

Solution:

Root Cause: Next Generation Cryptography (NGC) Container Key Desynchronization

Windows Hello fingerprint biometrics are bound directly to a hardware TPM 2.0 security key stored within the system NGC container directory. If a Windows update alters the TPM PCR (Platform Configuration Register) validation measurements, access to the encrypted NGC container is blocked. Biometric setup succeeds during image capture but fails at final key binding.

# Diagnostic Verification:

Open PowerShell as Administrator and run:

powershell
  Get-Tpm

Confirm TpmReady : True and TpmEnabled : True. If TPM is operational, NGC key corruption is confirmed.

# Step-by-Step Fix:

1. Take Ownership and Purge system NGC Directory:

Boot system into Safe Mode or open Admin Command Prompt.

Execute the following commands to gain full control of the folder:

cmd
     takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /r /d y
     icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /grant administrators:F /t

Delete all contents inside the NGC directory:

cmd
     rd /s /q C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC

2. Re-initialize NGC Container Directory Structure:

Re-create the folder structure if deleted completely:

cmd
     md C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC

3. Restart System and Reset Windows Hello Credentials:

Reboot back into normal Windows mode.

Navigate to Settings > Accounts > Sign-in options.

Create a new PIN first (required to initialize NGC key space).

Click Windows Hello Fingerprint and complete setup.

# Prevention & Long-Term Monitoring:

Clear TPM keys only through Windows Security UI and maintain BitLocker recovery keys in a safe location before editing system cryptographic stores.

Which Device Manager error code is present in the properties of the biometric sensor or USB controller?

Code 10: 'This device cannot start' or Code 43: 'Windows has stopped this device because it has reported problems.'
Code 28: 'The drivers for this device are not installed' or Code 45: 'Device is not connected.'

Resolving Hardware Code 10/43 Errors via Power Cycle and Firmware Reset

Solution:

Root Cause: Sensor Firmware Lockup or PCI/USB Interface Bus Hang

Error Code 10 or Code 43 indicates that the fingerprint reader hardware failed to complete its internal initialization routine. Post-update reboot sequences can leave the biometric sensor's embedded microcontroller in an undefined state where it fails respond-to-descriptor requests sent by the host host-controller driver.

# Diagnostic Verification:

Open PowerShell as Administrator and execute:

powershell
  Get-PnpDevice | Where-Object {$_.Status -eq "ERROR" -or $_.ConfigManagerErrorCode -in @(10, 43)}

# Step-by-Step Fix:

1. Perform a Flea Power / Static Discharge Reset (Laptops):

Shut down the computer completely.

Unplug AC power adapter and disconnect all external peripheral cables.

Press and hold the laptop physical Power button continuously for 30 seconds to drain residual capacitive power on the motherboard.

Reconnect power supply and boot Windows.

2. Force Re-initialization via Device Manager:

Open devmgmt.msc.

Right-click the affected Fingerprint Sensor and click Disable device.

Wait 10 seconds, then right-click and click Enable device.

3. Update Chipset and Host Bus Drivers:

Download and install the latest Intel Management Engine (ME), Intel Serial IO, or AMD Chipset Drivers from your device vendor's official support site.

4. Re-verify status in Device Manager.

# Prevention & Long-Term Monitoring:

Ensure ACPI chipset driver updates are applied alongside major Windows feature updates to maintain bus state synchronization.

Installing Missing Driver INF Packages via Driver Store Provisioning

Solution:

Root Cause: Missing Driver Package File Pointer (Code 28) or Disconnected Hardware (Code 45)

Code 28 indicates that the driver software for the fingerprint reader was uninstalled during update staging and no suitable .inf file was located in C:\Windows\INF. Code 45 indicates that the system bus lost communication with the physical sensor module.

# Diagnostic Verification:

Open Admin Command Prompt and list all biometric driver packages in the system store:

cmd
  pnputil /enum-drivers | findstr /i "Biometric"

# Step-by-Step Fix:

1. Locate and Extract OEM Driver Archive:

Download the official driver zip package from the OEM support portal (Dell, HP, Lenovo, Asus).

Extract the package to a known folder (e.g., C:\Drivers\Fingerprint).

2. Manually Inject Driver via Pnputil:

Open Admin Command Prompt and run:

cmd
     pnputil /add-driver "C:\Drivers\Fingerprint\*.inf" /subdirs /install

3. Manually Update Driver in Device Manager:

Open devmgmt.msc.

Right-click the problem device (under Other Devices or Biometric Devices) and choose Update driver.

Select Browse my computer for drivers, point to C:\Drivers\Fingerprint, and ensure Include subfolders is checked.

Complete wizard installation.

4. Reboot system to finalize WBF framework registration.

# Prevention & Long-Term Monitoring:

Keep local backups of original OEM driver archives (C:\Drivers) prior to performing major OS upgrades.

Related Diagnostic Guides

Windows 11 24H2 KB504 Failed to Install: Cleanup & Fix

User Profile Service Failed Logon: Create New Profile Without Losing Data

Clipboard History Not Syncing Across Devices: Diagnostic & Repair Guide

Embed Guide on Your Website