Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Quick path: In Windows 11 version 24H2 or newer, open Settings > Accounts > Sign-in options > Additional settings, then use Enhanced sign-in security when the switch is shown. Turning it on restricts Windows sign-in to Windows Hello biometric hardware that supports Enhanced Sign-in Security (ESS). Turning it off permits compatible non-ESS peripherals. On version 23H2, Microsoft uses a different control called Sign in with an external camera or fingerprint reader, and its practical on/off meaning is reversed. See Microsoft’s current guidance for the labels and behavior: Enhanced Sign-in Security in Windows.
This guide explains what ESS protects, how to configure each Windows 11 release, what happens to enrollments and passkeys, and how to choose an external fingerprint reader or camera without confusing generic Windows Hello compatibility with ESS support.
What Enhanced Sign-in Security does
Enhanced Sign-in Security is a Windows Hello protection mode for biometric sign-in. Microsoft describes it as adding a layer of protection to biometric data with specialized hardware and software components, including Virtualization Based Security (VBS) and Trusted Platform Module (TPM) 2.0. The intended security boundary covers the path from the biometric sensor through processing and storage of the user profile, rather than treating an attached reader as an ordinary USB input device.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Enhanced Sign-in Security adds a layer of security to biometric data by using specialized hardware and software components, for example, Virtualization Based Security (VBS) and Trusted Platform Module 2.0.
#1 Best Overall
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ESS is therefore a compatibility choice as well as a security setting. When it is enabled, Windows refuses biometric authentication from a peripheral that does not meet the ESS requirements, even if that peripheral is otherwise advertised as Windows Hello compatible. When it is disabled, Windows can use compatible non-ESS readers and cameras, subject to the normal Windows Hello requirements. The same hardware can still be useful inside applications while ESS is enabled; Microsoft specifically notes that external peripherals can remain available in apps such as Teams even when they cannot authenticate a Windows sign-in. Details are in Microsoft’s ESS documentation.
Check your Windows 11 version before changing anything
The wording and polarity of the setting depend on the release. Open Settings > System > About and read the Windows specifications, or type winver in the Start menu and note whether the release is 24H2, 23H2, or another version. Then use the matching procedure below. Do not assume that the 23H2 control behaves like the 24H2 switch.
| Windows 11 release | Control shown by Microsoft | Meaning when enabled or turned on |
|---|---|---|
| Version 24H2 or newer | Enhanced sign-in security | ESS is enabled; non-ESS Windows Hello peripherals cannot sign in to Windows. |
| Version 23H2 | Sign in with an external camera or fingerprint reader | The option is on, ESS is disabled, and compatible external peripherals are allowed to sign in. |
These labels and behaviors are documented by Microsoft at Enhanced Sign-in Security in Windows.
Configure ESS on Windows 11 version 24H2 or newer
Use this procedure when your system exposes the modern ESS control.
- Open Settings. Select Start > Settings, or press
Windows + I. - Open sign-in settings. Select Accounts, then Sign-in options.
- Expand Additional settings. Look for Enhanced sign-in security. Microsoft says the option appears when relevant biometric sensors are present and recognized.
- Choose the security or compatibility priority. Turn the switch on to require ESS-capable Windows Hello biometric hardware. Turn it off if you need to authenticate with a compatible external reader that does not support ESS.
- Complete any requested confirmation and test sign-in. Lock the computer with
Windows + L, then try the enrolled fingerprint or face method. If the selected reader is non-ESS, it will not authenticate Windows while the switch is on.
With the modern switch on, non-ESS peripherals are blocked specifically for Windows authentication; that does not automatically disable their use by applications. For example, an external camera or reader may continue to function in an application such as Teams. Microsoft documents this distinction in its Windows ESS guidance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When the modern switch is available but already off
An off switch means Windows is permitting non-ESS Windows Hello-compatible peripherals. It does not prove that the installed sensor is defective or that ESS is unavailable. If the sensor supports ESS and you want the tighter controlled path, turn the switch on and enroll an ESS-capable sensor. If you depend on a non-ESS reader, leave the switch off and verify that the reader is supported by its manufacturer.
Configure the legacy control on Windows 11 version 23H2
On 23H2, open Settings > Accounts > Sign-in options > Additional settings and find Sign in with an external camera or fingerprint reader. This is not a renamed copy of the 24H2 switch; its practical polarity is opposite.
- Turn the option on when you need a compatible external camera or fingerprint reader to authenticate Windows. On this release, turning it on disables ESS.
- Turn the option off when you want ESS enabled. A non-ESS external peripheral may then stop working for Windows sign-in.
- Lock and unlock the computer after changing the setting so you can verify the result with the intended sensor.
Remember the distinction: on 24H2, the ESS switch being on means ESS is enabled; on 23H2, the external-peripheral option being on means ESS is disabled. Carrying the newer switch’s polarity back to 23H2 can produce the exact opposite of the state you intended. Microsoft lists both behaviors in its version-specific instructions.
If no ESS setting appears
Not every PC shows a switch. Microsoft says a device may instead present ESS as an enrollment choice, and the first sensor you enroll determines the state. Enrolling an ESS sensor first results in ESS being on; enrolling a non-ESS sensor first results in ESS being off.
- Check the release. Confirm that the PC is running a Windows 11 release covered by the documentation and that you are looking under Accounts > Sign-in options > Additional settings.
- Check for a recognized sensor. The control is associated with relevant biometric hardware. A PC without a detected fingerprint reader or compatible camera may not expose it.
- Consider organization policy. A work or school administrator can control sign-in features, so a managed device may hide or restrict the setting.
- Enroll deliberately when prompted. If Windows offers setup instead of a switch, enroll the ESS-capable sensor first when you want ESS enabled. Enrolling a non-ESS sensor first establishes the non-ESS state.
- Allow for phased availability. Microsoft says the feature is rolling out in phases, so two otherwise similar devices may not display the same control at the same time.
These possibilities are covered in Microsoft’s ESS and third-party hardware guidance: Enhanced Sign-in Security in Windows and Using third-party fingerprint readers and cameras with Windows Hello.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Understand biometric hardware compatibility
The phrase Windows Hello compatible is not sufficient to establish ESS support. A reader can meet ordinary Windows Hello requirements yet lack the specialized hardware or software path that ESS requires. Confirm the exact model, not just the product category, with the manufacturer before changing a working sign-in setup.
| Hardware or option | ESS status | What to expect |
|---|---|---|
| Fingerprint reader specifically confirmed as ESS-capable | Supports ESS | Can be used for Windows sign-in while the 24H2 ESS switch is on, assuming Windows recognizes the device and it is enrolled. |
| Third-party fingerprint reader labeled Windows Hello compatible but without ESS confirmation | Model dependent; may not support ESS | It may require ESS to be turned off before it can authenticate Windows. Verify the exact model with its manufacturer. |
| External camera module | Not supported for ESS | It cannot provide an ESS biometric path. A compatible camera can still be relevant to Windows Hello face sign-in under the normal camera requirements, and external cameras can be used by applications while ESS is on. |
| Physical security key | Not an ESS configuration method | It is a separate Windows sign-in option, not a way to make a camera or fingerprint reader ESS-capable. |
Microsoft states that external camera modules are not supported for ESS and that some, but not all, external fingerprint readers marked Windows Hello compatible support ESS. Its hardware details are in Using third-party fingerprint readers and cameras with Windows Hello. Windows Hello’s general setup requirements are listed in Configure Windows Hello.
Choose whether to enable or disable ESS
There is no universal setting that is best for every device. Use the factors below to make the choice explicit.
| Your situation | Appropriate state | Reason |
|---|---|---|
| You have an ESS-capable sensor and want biometric authentication confined to the protected path | Enable ESS | Windows rejects non-ESS biometric peripherals for sign-in. |
| You need a particular external fingerprint reader and the manufacturer does not confirm ESS support | Disable ESS | The reader may be usable for Windows sign-in only when non-ESS peripherals are allowed. |
| You mainly use an external camera or reader inside applications | Keep ESS enabled if your sign-in sensor supports it | ESS blocks non-ESS authentication, not ordinary application use; Microsoft gives Teams as an example of continued app access. |
| You are unsure whether a reader supports ESS | Verify the exact model before changing the switch | Generic Windows Hello labeling does not establish ESS compatibility. |
| You are on Windows 11 23H2 | Interpret the legacy option, not the 24H2 wording | On 23H2, turning on external-peripheral sign-in disables ESS. |
ESS is a security-versus-compatibility decision. Enabling it narrows the biometric sign-in hardware that Windows will trust; disabling it broadens hardware compatibility but removes that ESS restriction. The relevant Microsoft explanations are in Enhanced Sign-in Security in Windows.
What happens when you turn ESS off
Disabling ESS is not a harmless temporary toggle for existing enrollments. Microsoft says that turning ESS off removes existing ESS enrollments and associated credentials, including passkeys. After the change, you can set up the available Windows Hello methods again, but you should expect to repeat enrollment rather than assuming the old biometric template will return automatically.
Recommended Free Tools
Rank #4
- WINDOWS HELLO LOGIN FOR WINDOWS 10/11 — NOT FOR MAC - Only works with Windows Hello on Windows 10/11 PCs and laptops. Plug the USB fingerprint reader into your computer and sign in with one touch. Not compatible with Mac, macOS, Linux, or Chrome OS. Requires Windows Hello PIN setup first for fingerprint enrollment.
- PLUG-AND-PLAY, NO DRIVERS NEEDED - No extra app or driver needed on most genuine Windows 10/11 systems. Insert the USB fingerprint scanner, go to Windows Settings > Accounts > Sign-in options, and set up fingerprint sign-in. Works with desktops, laptops, and shared computers without built-in sensors
- FAST 0.5S 360° CAPACITIVE RECOGNITION - Capacitive fingerprint technology delivers quick authentication in about 0.5 seconds. 360° touch recognition reads your fingerprint from different angles. Compared to optical sensors, capacitive sensors are more accurate and less prone to misreads—ideal for shared PCs.
- MULTI-USER & SMART-ID SECURITY - Supports multiple Windows accounts and up to 10 fingerprints per account. Smart-ID security helps protect saved passwords and encrypted folders with fingerprint access. Compatible with most Windows 10/11 laptops and desktops, including Dell, HP, Lenovo, and ASUS. For USB-C only laptops, a USB-A to USB-C adapter is required (not included). 1-year warranty.
- IMPORTANT NOTES — PLEASE READ BEFORE PURCHASE - Supports Win10/11 32/64-bit original system. Not for streamlined/Lite versions (biometric component removed).Only supports Windows Hello. Does not encrypt USB drives/files. Windows only — not for Mac.Prefer motherboard USB 2.0 port. USB 3.0 hubs/docking stations may cause unstable recognition.
- Record another sign-in method first. Make sure you know your account password or have another sign-in option available before changing biometric security.
- Change the ESS setting. Use the 24H2 switch or the 23H2 legacy control appropriate to your release.
- Expect old ESS credentials to be removed. Existing ESS biometric enrollments and associated credentials such as passkeys may no longer be present.
- Re-enroll the hardware you intend to use. Add the fingerprint or face method again after Windows accepts the new security state.
- Recreate passkeys if needed. Any passkey removed with the ESS enrollment must be provisioned again through the service where it was originally created.
Microsoft documents these consequences in Using third-party fingerprint readers and cameras with Windows Hello. Plan the change when you have access to your password and recovery methods.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set up Windows Hello after the security state is correct
Once ESS is set to the state your hardware requires, configure the biometric method from Settings > Accounts > Sign-in options. Microsoft’s Windows Hello guidance says face sign-in requires a compatible camera and fingerprint sign-in requires a fingerprint reader. The hardware must be recognized by Windows before the corresponding setup option can be completed.
- Open Settings > Accounts > Sign-in options.
- Select Facial recognition (Windows Hello) or Fingerprint recognition (Windows Hello), depending on the installed sensor.
- Select Set up and follow the enrollment prompts.
- Lock the PC and test the method from the Windows sign-in screen.
If the setup option is missing, first resolve sensor detection and ESS compatibility rather than repeatedly enrolling. The general requirements are described in Configure Windows Hello.
Troubleshoot common ESS problems
The Enhanced sign-in security switch is missing
Confirm the Windows release and expand Additional settings. If the PC has no recognized relevant sensor, the control may not be offered. A managed computer may have a policy that hides it, and Microsoft’s phased rollout means the feature may not yet be exposed on every eligible device. If Windows offers sensor enrollment instead, use the first-sensor rule: ESS sensor first for ESS on, non-ESS sensor first for ESS off.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMy fingerprint reader stopped signing in after I enabled ESS
This usually indicates that the reader is non-ESS, even if its packaging says Windows Hello compatible. Check the exact model’s ESS support with the manufacturer. If it does not support ESS, either use an ESS-capable reader or turn ESS off and re-enroll the reader. Turning ESS off can remove existing ESS enrollments and related credentials, so keep another sign-in method available.
Best Value
- You can use your B220H security key to logon to your local Windows10 and Windows 11 PC via Windows Hello. (*Windows 10 Version 1903 and beyond)
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with B220H security key. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Strong security without worrying about fingerprint data breach: B220H is designed with strong security with fingerprint recognition algorithm using MS500 security chip designed by eWBM. This prevents information being leaked and hijacked.
- Fits USB-C port : Once the fingerprint registration is completed, insert the B220H security key into the USB-C port of each service and log in conveniently with one touch.
- For the driver download and user guide, please visit TrustKey Home support page.
The 23H2 setting seems backwards
It is backwards only if you compare it with the 24H2 label. On 23H2, Sign in with an external camera or fingerprint reader turned on means external sign-in is allowed and ESS is disabled. Turn it off to enable ESS. Do not use the 24H2 rule of thumb that an on switch always means more ESS protection.
An external camera works in an app but not at the Windows sign-in screen
Application access and Windows authentication are separate. Microsoft says external peripherals can remain usable in apps while ESS is enabled, but external camera modules are not supported for ESS authentication. A camera that works for meetings or recording therefore does not prove that it can provide an ESS Windows Hello sign-in path.
My passkeys or biometric enrollments disappeared
That can be the expected result of turning ESS off. Microsoft says existing ESS enrollments and associated credentials, including passkeys, are removed when ESS is disabled. Re-enroll the biometric method and reprovision passkeys after the hardware and security state are finalized.
Free tools Windows power users keep installed
One-click scans. No signup required.
The reader is detected but Windows Hello setup still fails
Check three separate conditions: the reader must meet Windows Hello’s fingerprint requirement, the model must support the current ESS state, and the account must be allowed to configure sign-in methods. A generic USB connection or a Windows Hello logo does not settle the ESS question. If the device is organization-managed, ask the administrator whether policy limits biometric sign-in.
Do not confuse a security key with ESS
Microsoft lists a physical security key as another Windows sign-in option. It can be useful when you prefer hardware-based authentication or cannot use biometrics, but it does not convert an external camera or fingerprint reader into an ESS device and it does not change the ESS toggle’s behavior. Treat it as a separate sign-in method, documented in Sign-In Options in Windows.
Final configuration checklist
- Identify whether the PC runs Windows 11 24H2 or newer, or 23H2.
- Open Settings > Accounts > Sign-in options > Additional settings.
- On 24H2 or newer, use Enhanced sign-in security: on means ESS enabled; off allows non-ESS peripherals.
- On 23H2, interpret Sign in with an external camera or fingerprint reader in the opposite way: on disables ESS; off enables it.
- Confirm ESS support for the exact fingerprint-reader model. Do not rely only on a Windows Hello-compatible label.
- Do not expect an external camera module to support ESS.
- Before disabling ESS, ensure you have a password or another sign-in method because ESS enrollments and associated credentials such as passkeys may be removed.
- After changing the state, re-enroll Windows Hello and test from the locked sign-in screen.
The practical rule is simple: enable ESS when your sensor supports it and you want the protected biometric path; disable it only when you deliberately need a non-ESS peripheral and accept the enrollment and credential changes that follow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
