How to enable anti-spoofing protection for Windows Hello Face on Windows 11

Enable Windows Hello facial recognition protection from Settings
Enable Windows Hello facial recognition protection from Group Policy
Enable Windows Hello facial recognition protection from Registry

On Windows 11, you can enhance the sign-in experience using the Windows Hello facial recognition with the anti-spoof protection feature, and in this guide, I’ll explain the steps to complete this configuration.

Windows Hello offers enhanced facial recognition protection, an anti-spoofing feature designed to make it significantly harder for malicious actors to use photos or videos to trick the system into unlocking.

It’s important to note that enabling enhanced anti-spoofing can affect the usability of external cameras for Windows Hello facial recognition. As a result, devices without advanced hardware might struggle or fail to authenticate. Also, a poorly lit environment might make facial recognition more challenging due to the increased standard for recognition.

If this feature is enabled and negatively affects your sign-in experience, it’s best to disable it.

In this guide, I’ll outline the different ways to turn on facial recognition protection for Windows Hello on Windows 11.

Warning: Before proceeding, it’s crucial to acknowledge the risks associated with modifying the Windows Registry. Incorrect changes can lead to system instability or operational issues. Therefore, ensure you have a full system backup before making any changes. Proceed with caution and understanding.

Enable Windows Hello facial recognition protection from Settings

To enable anti-spoofing protection for Windows Hello Face, follow these steps:

Open Settings on Windows 11.
Click on Accounts.
Click the Sign-in options page.
Click the “Facial recognition (Windows Hello)” setting.
(Option 1) Check the “Enhanced facial recognition protection” option to enable the anti-spoofing feature.
(Option 2) Clear the “Enhanced facial recognition protection” option to disable the anti-spoofing feature.
Click the Restart now button.

Once you complete the steps, the system will be less vulnerable to spoofing the face recognition experience.

Enable Windows Hello facial recognition protection from Group Policy

To enable anti-spoofing protection for Windows Hello Face on Windows 11 Pro, Enterprise, or Education, follow these steps:

Open Start.
Search for gpedit and click the top result to open the Local Group Policy Editor.

Open the following path:

Computer Configuration > Administrative Templates > Windows Components > Biometrics > Facial Features

Right-click the Configure enhanced anti-spoofing policy and choose the Edit option.
Select the Enabled option.
Click the Apply button.
Click the OK button.
Restart the computer.

After you complete the steps, the enabled protection for Windows Hello Face will turn on.

If you change your mind, you can always turn off the feature using the same instructions, but in step 6, choose the “Not Configured” option.

Enable Windows Hello facial recognition protection from Registry

To enable anti-spoofing protection for Windows Hello Face with the Registry, follow these steps:

Open Start.
Search for regedit and click the top result to open the Registry Editor.

Open the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\

Right-click the Microsoft key, select the New menu and choose the Key option.
Confirm the Biometrics name for the key and press Enter.
Right-click the Biometrics key, select the New menu, and choose the Key option.
Confirm the FacialFeatures name for the key and press Enter.
Right-click the FacialFeatures key, select the New menu, and choose the “DWORD (32-bit) Value” option.
Confirm the EnhancedAntiSpoofing name for the key and press Enter.
Right-click the newly created key and choose the Edit option.
Change the value from 0 to 1.
Click the OK button.
Restart the computer.

Once you complete the steps, the facial recognition protection for Windows Hello should now be enabled on the computer.

If you want to disable the feature, you can use the instructions, but in step 5, right-click and delete the “Biometrics” key or set the value of the “EnhancedAntiSpoofing” DWORD from 1 to 0.