Offline biometrics troubleshooting

Resolve common issues that users may encounter when using offline biometric factors for Okta Device Access (ODA) on Windows.

Slow sign-in screen after a reboot

After restarting the computer, the Windows sign-in screen takes a while to appear.

Cause

This delay can occur if the Windows biometric service (WbioSrvc) isn't running. The ODA credential provider attempts to connect to the service, and the delay is a result of the connection timing out.

Remedy

  1. Open the Services app on the affected Windows machine.
  2. Locate the Windows Biometric Service.
  3. Ensure that its status is Running and its startup type is set to Automatic.
  4. If the service is stopped, start it and monitor the device on the next reboot to confirm the issue is resolved.

User gets locked out when using biometrics with other offline factors

A user who has configured both biometrics and another offline factor (like a security key) is locked out of their device. They must perform an online sign-in.

Cause

This occurs if the PrioritizeBiometrics registry key is enabled alongside other offline factors. If the biometric prompt is bypassed or fails, the system attempts to use the next available offline factor.

If the user exceeds the maximum number of allowed offline logins (MaxLoginsWithOfflineFactor), they're locked out.

Remedy

  1. To reset the offline sign-in counter, the user needs to connect to the internet and perform an online authentication with Okta.
  2. To address this issue, avoid mixing other offline factors with the PrioritizeBiometrics setting. If multiple offline factors are required, don't set the PrioritizeBiometrics key to 1.

A biometric prompt no longer appears at the Windows sign-in screen

The option to sign in with a face or fingerprint is no longer available at the Windows sign-in screen, and the user is prompted for their password instead.

Cause

This happens if the user has unenrolled their face or fingerprint from Windows Hello in the local device settings. Unenrolling from Windows Hello immediately disables the biometric factor for ODA.

Remedy

  1. The user must sign in to Windows using their password.
  2. Open Windows Settings > Accounts > Sign-in options and re-enroll their face or fingerprint in Windows Hello.
  3. After being re-enrolled, Okta Verify prompts the user to re-register the biometric factor for ODA. After registration, the passwordless sign-in option is restored.