BSI Analysis Finds Windows Hello Biometrics Can Be Bypassed by Admins

TPM Limitations and Local Administrator Risks

The BSI-commissioned work, conducted by ERNW (Enno Rey Netzwerke) using reverse engineering and debugging techniques, focused on facial recognition within Biometricupdate on Windows 10 Enterprise LTSC 2021. While Windows Hello for Business uses a Trusted Platform Module (TPM) to protect the cryptographic keys used for enterprise authentication, the BSI found that the TPM does not protect all biometric data.

Facial templates are stored in a local biometric database managed by the Windows Biometric Service. Although Windows encrypts these templates and uses file permissions to restrict access, the BSI analysis determined that the information required to access the encrypted database remains available on the same computer. Consequently, local administrators can decrypt both the database and the stored templates.

This creates a security gap where an attacker with substantial control of a local device may not need to extract a TPM-protected private key. Instead, they could modify enrollment records in the biometric database. Because each biometric record is linked to a Windows security identifier (SID), an attacker who changes that association could cause the system to recognize one person’s face but return the identity of a different authorized user.

Enhanced Sign-in Security (ESS) as a Mitigation

The BSI report notes that the security model changes fundamentally when Enhanced Sign-in Security (ESS) is activated. ESS moves sensitive biometric operations away from the standard Windows environment into an isolation boundary built upon TPM 2.0, compatible biometric hardware, and Virtualization-based Security (VBS).

In ESS mode, the TPM is utilized for replay protection and HMAC-based authorization tickets. Because of the vulnerabilities found in the standard configuration, the BSI expressly recommends activating ESS. However, the authority cautioned that very few sensors currently provide full support for this mode.

Presentation Attacks and PIN Alternatives

Beyond administrator-level threats, the BSI conducted tests on what the facial recognition system accepts at the sensor. Researchers discovered that Windows Hello allowed the enrollment of a facial mask instead of a real face. Once this enrollment was complete, the researchers were able to authenticate using a different mask depicting the same person. The report classifies this as a presentation attack.

Due to these findings, the BSI considers a sufficiently long PIN—combined with TPM and brute-force protection—to be partially more favorable than biometric authentication when ESS is not present, specifically regarding the threat model of an attacker with local administrator rights.

Enterprise Implications

The BSI analysis reconstructed the full authentication process involving Microsoft Passport, LSASS, Kerberos, the Windows Biometric Service, and FaceCredentialProvider. The report concludes that enterprise protection depends on several variables:

• The specific biometric hardware installed.
• How local administrator access is controlled.
• Who is permitted to perform enrollment.
• Whether the biometric process is isolated via Enhanced Sign-in Security.
• How the device is configured.

Despite these local vulnerabilities, the BSI noted that Windows Hello for Business continues to protect against typical attacks such as password theft or phishing, as the actual authentication secret does not leave the device.