Windows 7 and Windows Server 2008 R2 include the Windows Biometric Framework (WBF), which provides native support for biometric technologies, specifically fingerprint devices.
To set up biometric (fingerprint) logon to a Windows 7 computer, you first need a fingerprint reader. This can be an add-on device, or a reader that comes built-in (as is the case with many modern laptops). The proper drivers for the device must be installed. Windows 7 comes with drivers for a number of biometric devices. If yours isn’t one of them, Windows will attempt to find the correct drivers on the Windows Update site. If that doesn’t work, check the web site of the device vendor (or the computer vendor for built-in devices).
Once the drivers are installed, the next step is to set up the biometric software with your fingerprint data. Follow these steps:
- Log on to the user account with which you want to use biometric logon.
- Click Start | Control Panel.
- In Classic View, click the Biometric Devices applet. If you don’t see this applet, check Device Manager to ensure that your biometric device is listed.
- In the dialog box, click “Use your fingerprint with Windows.”
- Next, you’ll be asked to provide your password. Do so and click OK.
- The Fingerprint Reader enrollment dialog box requests that you click the finger you want to set up. You can set up one, some or all of your fingers. It’s usually a good idea to set up more than one, as sometimes the reader may not recognize one of your fingers (perhaps because it’s dirty or oily or injured) but will recognize a different finger.
- Next you’ll be asked to swipe the finger on the reader so the reader can get a good reading. A successful swipe will result in a green checkmark; an unsuccessful swipe will result in a red X. You’ll need three successful swipes to proceed.
- After three successful swipes, you’re notified that the finger is set up for logon and access functions and you can click Finish.
- You can repeat the process to enroll other fingers.
Now you need to test and ensure that the fingerprint logon works. Log off (or lock the computer). Instead of your photo and a credentials box for entering your password, you’ll now see a fingerprint icon, as fingerprint logon has been set as the default logon method. Don’t worry; if it doesn’t work, you can click the “Other credentials” button and log on with your username and password as usual.
Swipe one of the fingers that you set up and the system should log you on.
Managing Biometrics in Windows 2008 R2 Domain
We can enable, limit or block the use of biometric devices in a Windows Domain by using Group Policy. In the Group Policy Management Editor on Windows Server 2008 R2, in the left pane right click the Group Policy Object (GPO) you want to configure (for example, the default domain policy) and select “Edit,” as shown below.
In the left pane, expand Policies, then Administrative Templates: Policy definitions, then Windows Components, and click Biometrics as shown below.
In the right pane, you’ll see four choices:
- Allow the use of biometrics
- Allow users to log on using biometrics
- Allow domain users to log on using biometrics
- Timeout for fast user switching events
Note that this same Group Policy settings are available in the Local Group Policy Editor on Windows 7 and Windows Server 2008 R2 computers. The permissions and behaviors of biometrics can be configured in the local policy; however, domain policy will override local policy.
Allow the use of biometrics: If you enable the “Allow the use of biometrics” policy setting, this makes the Windows Biometric Service available to user applications. This means users will be able to run biometric applications on their Windows 7 clients or on Windows Server 2008 R2 servers. This setting does not enable users to log on with biometric data; it only allows them to run the biometric-enabled applications.
If the policy is not configured, WBS will still be available, as that is the default. If you don’t want it to be available (thus prohibiting users from running biometric applications), you need to explicitly disable this policy setting. This prevents users from using any of the biometric features in Windows 7 and Windows Server 2008 R2. To enable or disable the policy setting, double click it or right click it and select “Edit.” There you have three option buttons: Not Configured, Enabled and Disabled. Click the one you want and then click Apply and OK.
Allow users to logon using biometrics: If you enable the “Allow users to log on using biometrics” policy setting, users will be able to log onto their computers by swiping a finger. They will also be able to elevate User Account Control (UAC) permissions with a finger swipe (if they are logged on with an administrative account). This only allows users to log onto the local computer; it does notenable them to log onto the Windows domain.
As with the previous policy, the default of Not Configured has the same effect as selecting Enabled, so if you don’t want users to be able to log onto their computers or elevate privileges using biometrics, you’ll need to explicitly disable the policy setting. This is done in the same way we edited the policy setting above.
Allow domain users to logon using biometrics: The purpose of this policy setting is self evident; if you enable it, users who have domain accounts will be able to log onto the Windows domain, or elevate privileges with a logged on domain account, by swiping a finger. The default here is different from those above. Because in a domain, the principle of least privilege applies, domain users can not use biometrics to log on by default. Thus the “Not Configured” selection in this case has the same effect as the “Disabled” selection, and you will need to explicitly enable the policy setting if you want domain users to be able to log onto the domain using biometrics.
Timeout for fast user switching event: You can use this policy setting to set a specified time period (in seconds) for which a fast user switch event stays active before the switch happens. The default time period is 10 seconds. The maximum time period you can configure is 60 seconds. You need to enable the policy setting to change the specified time period.
