Free tools Windows power users keep installed
One-click scans. No signup required.
On Windows 11 version 24H2 and later, open Settings > Accounts > Sign-in options > Additional settings, find Enhanced sign-in security, and use its toggle. Turn it on for the controlled, hardware-backed biometric path; turn it off only when you need a non-ESS external Windows Hello peripheral. Windows 11 version 23H2 uses a differently named control whose practical on/off behavior is reversed.
The setting may be absent because your PC has not received the staged feature, the required sensor is not detected, or an organization policy controls sign-in. The steps below explain each version, the effect on fingerprints, cameras and passkeys, and what to do when the option is missing.
As an Amazon Associate I earn from qualifying purchases.
Check your Windows 11 version before changing ESS
The label and meaning of the setting depend on the Windows release. Press Windows key + R, type winver, and press Enter. In the About Windows dialog, note whether the release is 24H2 (or newer) or 23H2. Do not apply the 24H2 instructions to 23H2: the older control has the opposite practical polarity.
You also need an enrolled or detectable Windows Hello sensor for the relevant controls to appear. Windows Hello face sign-in requires a compatible camera, while fingerprint sign-in requires a compatible fingerprint reader. Microsoft describes those hardware requirements in its Windows Hello configuration guidance.
#1 Best Overall
- Have an administrator account available if Windows asks for permission to change sign-in settings.
- Keep a password or PIN available. You may need it to enter Sign-in options and to recover if a biometric enrollment is removed.
- If you use a USB fingerprint reader, connect it directly to the computer while checking the setting rather than through an unpowered hub.
- Record which fingerprints or face profile are currently enrolled if you may disable ESS; disabling it can remove those enrollments and related credentials.
ESS is a Windows Hello security mode, not a separate sign-in method. A security key, PIN or password remains an independent way to sign in.
Configure ESS on Windows 11 version 24H2 or newer
Microsoft’s current interface for 24H2 and later calls the control Enhanced sign-in security. When the control is present, its state is straightforward: On enables ESS and Off allows compatible non-ESS Windows Hello peripherals to be used for Windows sign-in. The complete path and behavior are documented in Microsoft’s Enhanced Sign-in Security in Windows article.
- Open Start > Settings.
- Select Accounts, then Sign-in options.
- Expand Additional settings.
- Locate Enhanced sign-in security.
- Set the toggle to On to require ESS-capable biometric hardware for Windows sign-in, or to Off when a non-ESS Windows Hello peripheral must authenticate Windows.
- Close Settings, then lock the PC with Windows key + L and test the intended sign-in method.
What “On” means in 24H2 and later
With ESS enabled, a biometric peripheral must support ESS to authenticate Windows. A reader that is merely labeled “Windows Hello compatible” can still be rejected if it does not implement ESS. Turning ESS on does not disable every use of an external camera or reader: Microsoft says non-ESS peripherals can still be used by applications such as Teams while ESS remains enabled; they simply cannot be used to sign in to Windows.
What “Off” means in 24H2 and later
With ESS disabled, Windows can use compatible non-ESS Windows Hello fingerprint readers for sign-in. This is a compatibility choice, not a performance setting. If you do not need a non-ESS peripheral, leaving ESS enabled preserves the more tightly controlled biometric path.
Configure the legacy control on Windows 11 version 23H2
Version 23H2 does not use the newer wording. Its documented control is Sign in with an external camera or fingerprint reader, found under Settings > Accounts > Sign-in options > Additional settings. Its polarity is easy to misunderstand:
- On: ESS is disabled, allowing compatible external cameras or fingerprint readers to sign in to Windows.
- Off: ESS is enabled, which can prevent external peripherals that are not ESS-capable from authenticating Windows.
To change it, open the path above, set Sign in with an external camera or fingerprint reader to the required state, and then lock the PC to test sign-in. Do not read an “On” state on this 23H2 control as “ESS on”; it means external sign-in is allowed and ESS is turned off. Microsoft explains this version-specific behavior in its version guidance.
When the ESS toggle is missing
A missing toggle does not by itself mean that ESS is broken. Microsoft says the feature is rolling out in phases, so two otherwise similar PCs can expose different controls at the same time. Hardware detection and organization policy can also determine whether the control is shown. Start with these checks:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Confirm the release with
winver. The 24H2 label is different from the 23H2 legacy label. - Install the Windows updates offered under Settings > Windows Update, restart, and check Sign-in options again.
- Connect or enable the intended fingerprint reader or compatible camera, then return to Accounts > Sign-in options.
- Look for an ESS setup prompt rather than a switch. Microsoft says some devices present ESS as available for setup; the first sensor you enroll determines the initial state.
- If the PC belongs to a work or school organization, ask the administrator whether policy hides or controls biometric sign-in settings.
How first enrollment determines the state
On a device that offers setup instead of a toggle, enroll an ESS-capable sensor first if you want ESS enabled. The first ESS sensor enrollment establishes ESS on. Enrolling a non-ESS sensor first establishes ESS off. If you choose the wrong order, remove the enrollment and enroll the desired sensor first, using your PIN or password when Windows requests verification.
If no sensor is detected and no control appears after updates and a restart, Windows has not established that the relevant hardware is available for this feature. An external camera module will not solve that specific problem: Microsoft says external camera modules are not supported for ESS.
What ESS protects and what it does not do
Microsoft describes ESS as adding a security layer to biometric data through specialized hardware and software components. Its examples include Virtualization Based Security (VBS) and Trusted Platform Module 2.0 (TPM 2.0). The intended protection covers the path from the biometric sensor to the location where the user profile is stored. The official wording is: “Enhanced Sign-in Security adds a layer of security to biometric data by using specialized hardware and software components, for example, Virtualization Based Security (VBS) and Trusted Platform Module 2.0.” Read the full explanation in Microsoft’s ESS documentation.
ESS does not turn a conventional webcam into an ESS sensor, certify every third-party reader, or replace your PIN. It also does not prevent a camera or reader from being used inside an application. Its practical decision is narrower: which biometric devices are allowed to authenticate the Windows session.
Why specialized hardware matters
A generic “Windows Hello compatible” description only establishes compatibility with the Windows Hello framework. It does not establish ESS capability. ESS support is model dependent, so the manufacturer must identify the exact reader as ESS-capable for your Windows release. Microsoft’s guidance on third-party fingerprint readers and cameras makes this distinction explicit.
Choose the right ESS state for your hardware and security needs
Use the following comparison before moving the toggle. The version column is essential because the 23H2 control’s wording and polarity differ from 24H2.
| Situation | Recommended state | Windows 11 24H2 or newer | Windows 11 23H2 | Effect on sign-in |
|---|---|---|---|---|
| You have an ESS-capable fingerprint reader and want the protected biometric path | Enable ESS | Enhanced sign-in security: On | Sign in with an external camera or fingerprint reader: Off | ESS-capable biometric hardware can sign in; non-ESS external hardware cannot. |
| You need a non-ESS external fingerprint reader to sign in | Disable ESS | Enhanced sign-in security: Off | Sign in with an external camera or fingerprint reader: On | Compatible non-ESS external readers can authenticate Windows. |
| You use an external camera for Windows face sign-in | Check the model first | ESS does not support external camera modules | External-camera sign-in may require ESS to be disabled | A camera’s Windows Hello compatibility does not prove ESS support. |
| You only use the built-in sensor and do not need third-party hardware | Usually leave ESS enabled | On | Legacy control Off | Keeps Windows on the ESS path without sacrificing application camera use. |
This table describes sign-in behavior, not application access. Even with ESS enabled, an external camera or reader can remain available to supported applications such as Teams.
Check third-party fingerprint readers before buying or installing one
Fingerprint readers
Some external fingerprint readers marked as Windows Hello compatible also support ESS; others do not. Verify the exact model, firmware requirements and Windows 11 release with the manufacturer before purchase. If the reader is non-ESS, Windows may require ESS to be turned off before the reader can authenticate the lock screen. A retailer’s generic “Windows Hello” label is not enough evidence.
After connecting a reader, open Settings > Accounts > Sign-in options > Fingerprint recognition (Windows Hello) and choose Set up or Add a finger. If Windows reports that the device cannot be used while ESS is enabled, confirm the model’s ESS support rather than repeatedly reinstalling the driver. Microsoft’s compatibility notes are in its third-party reader guidance.
Cameras
Face sign-in requires a compatible camera, but Microsoft says external camera modules are not supported for ESS. Therefore, an external infrared camera can be relevant to Windows Hello face recognition while still being unable to provide ESS. Do not describe an external camera as an ESS upgrade. If you need face sign-in, verify Windows Hello camera compatibility in Microsoft’s setup instructions and check whether your Windows version requires the legacy external-camera option to be enabled.
Understand the consequences of turning ESS off
Disabling ESS is not a reversible cosmetic switch for existing enrollments. Microsoft says turning ESS off removes existing ESS enrollments and associated credentials, including passkeys. Those credentials can be reprovisioned after the new state is configured. Plan for re-enrollment before disabling ESS on a workstation that you must access immediately.
Before switching off
- Confirm that you know the account password and Windows Hello PIN.
- Make sure another sign-in method is available, such as the PIN, password or a physical security key.
- Note which fingers or face profile you will need to enroll again.
- If the PC is managed, check with the administrator before changing the state; policy may reapply the previous configuration.
After switching off
- Restart or lock and unlock the PC so Windows applies the new biometric policy.
- Return to Settings > Accounts > Sign-in options.
- Choose Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello), then select Set up and follow the enrollment prompts.
- Recreate any passkeys or other credentials that were removed with the ESS enrollment.
- Lock the computer and test the external device before relying on it.
If you later turn ESS back on, non-ESS external sign-in will stop working and you may need to enroll an ESS-capable sensor again. Do not remove your only working sign-in method until the replacement is tested.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Troubleshoot common ESS and Windows Hello problems
The setting is not listed
Check the Windows release, install pending updates, restart, and connect the relevant sensor. If the device offers setup instead of a toggle, enroll the ESS-capable sensor first. On a managed PC, an administrator policy may hide the control. Microsoft also notes that rollout is phased, so the feature may not yet be exposed on every eligible device.
The toggle is present but the reader will not sign in
On 24H2, check that ESS is Off if the reader is non-ESS. On 23H2, set Sign in with an external camera or fingerprint reader to On; that older control disables ESS. If the reader still fails, verify the exact model’s ESS capability, reconnect it, remove the old Windows Hello enrollment and enroll it again.
Biometric credentials disappeared
This is expected when ESS is disabled: existing ESS enrollments and associated credentials, including passkeys, can be removed. Sign in with your PIN or password and reprovision the fingerprint, face profile or passkeys from Sign-in options.
The camera works in an app but not at the Windows lock screen
Application access and Windows authentication are separate. ESS can leave a non-ESS camera available to an application while refusing it for Windows sign-in. Also remember that Microsoft does not support external camera modules for ESS. Use a supported built-in or ESS-appropriate biometric path, or follow the 23H2 external-camera setting when that is the release installed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWindows asks for a PIN instead of a fingerprint
Use the PIN to sign in, then inspect the biometric enrollment under Sign-in options. A state change can invalidate the old enrollment. Re-enroll the sensor after confirming that the reader and current ESS setting are compatible.
How ESS relates to other Windows sign-in options
ESS controls biometric hardware eligibility; it does not configure every sign-in method. Windows also supports passwords, PINs, face or fingerprint recognition and physical security keys. Microsoft lists these methods in its Sign-in options in Windows reference.
A physical security key can provide an alternative way to authenticate Windows, but it is not an ESS configuration method and does not make a camera or fingerprint reader ESS-capable. Keep a separate method available when changing ESS so that a removed biometric enrollment cannot lock you out.
Quick Recap
Final verification checklist
- Version checked: You confirmed whether the PC is running 24H2 or newer, or 23H2.
- Correct path used: Settings > Accounts > Sign-in options > Additional settings.
- Correct polarity used: 24H2’s Enhanced sign-in security toggle and 23H2’s legacy external-camera/fingerprint toggle are not interchangeable.
- Hardware verified: The exact fingerprint-reader model is confirmed as ESS-capable if ESS is enabled; external camera modules are not treated as ESS sensors.
- Credentials protected: A PIN, password or security key is available before changing ESS.
- Enrollment tested: Any removed fingerprint, face profile or passkey has been reprovisioned and tested at the lock screen.
- Application use separated: You understand that a peripheral can work in an application such as Teams even when it cannot authenticate Windows under ESS.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
