Germany's Federal Office for Information Security (BSI) has published the first technical analysis from its "Windows dissected" project. The 169-page report tears apart Windows Hello for Business (WHfB), Microsoft's PIN and biometric authentication solution for enterprise environments. It doesn't just describe the architecture — it reconstructs internal processes through reverse engineering and evaluates them from the perspective of an attacker with local administrator privileges.
TPM Doesn't Protect All Biometric Data
Windows Hello for Business replaces traditional passwords with key-based authentication. Users authenticate locally via PIN or biometric feature. The actual secret, a cryptographic key, stays on the device, ideally protected by the Trusted Platform Module (TPM). The device then authenticates to Active Directory or Microsoft Entra ID using this key, not a password.
The BSI analysis confirms this basic architecture but documents several limitations that Microsoft acknowledges only partially. Without the Enhanced Sign-in Security (ESS) mode, the TPM does not directly protect biometric templates for face recognition. While these are stored encrypted, the decryption key also remains locally available. Local administrators can therefore decrypt both the database and stored templates.
Activating ESS changes this security model fundamentally: security-critical parts of biometric processing are moved into a Virtualization-based Security (VBS) protected environment. The BSI explicitly recommends enabling ESS but notes that very few sensors currently support this mode fully.
Biometrics Add No Extra Entropy
The study is particularly critical of security assumptions behind biometric login. The BSI argues that biometric features, unlike a PIN, add no additional entropy to the system. A PIN provides fresh knowledge from the user at every login. Biometrics only serve to locally unlock already-present key material. For an attacker with admin rights, all required components are already on the machine.
The BSI therefore considers a sufficiently long PIN combined with TPM brute-force protection to be partially more secure than biometric login without ESS. This assessment applies specifically to the threat model of a local administrator attacker. Against typical attacks like phishing or credential theft, Windows Hello for Business remains effective.
One User Per Device
From the analysis, the BSI derives a concrete recommendation: only one user should be registered for Windows Hello per device. If a machine already holds the biometric template of another domain user, a local administrator could theoretically manipulate it or impersonate that user.
Beyond the security assessment, the report provides extensive technical details not previously documented. The BSI reconstructs the full authentication flow between FaceCredentialProvider, Windows Biometric Service, Microsoft Passport, LSASS and Kerberos. Practical tests are also included: poorly executed registrations increase the probability of misidentification. The publication marks the start of the BSI's "Windows dissected" series, with further analyses on Protected Process Light and Control Flow Guard to follow.