Most of our staff authenticate with Windows Hello for Business, which is TPM-backed and hardware-bound, and which we accept as a second factor. multiOTP exists for the users who sign in with a username and password and do not want to enrol in company biometrics or use a pin.
Because multiOTP takes the default position, a lot of users who use Windows Hello require some extra clicks for every sign-in and unlock.
Environment
- multiOTP Credential Provider 5.10.2.2 (64-bit)
- Windows 11 Enterprise, build 26200, domain-joined
cpus_logon / cpus_unlock / cpus_credui = 0e (exclusive)included_providers_id = NGC (Hello PIN) {D6886603-9D2F-4EB2-B667-1971041FA96B}; WinBio (fingerprint) {BEC09223-B018-416D-A0AC-523971B639F5}; Face {8AF662BF-65A0-4D0A-A540-A338A999D36F}- Windows Hello for Business enabled by policy,
RequireSecurityDevice = 1, forcing TPM usage.
Details
The Windows Hello tiles are correctly admitted by multiOTP via included_providers_id and works as expected. However, the multiOTP tile always has focus when the logon screen appears.
How much that impacts a user depends on the Hello method:
| Hello method |
Usable without touching the tile? |
| Fingerprint (WinBio) |
Yes, the reader stays active at the logon screen regardless of which tile is currently selected. multiOTP could be the active credential provider and using the Fingerprint reader will simply bypass multiOTP. These users are effectively unaffected. |
| PIN (NGC) |
No, the user must click their username in the lower-left, then pick the PIN sign-in option. |
| Face |
No, same as PIN. |
So, fingerprint users are fine, but PIN and face users need manual clicks on every sign-in and unlock.
Worth noting that as mentioned above, windows already remembers the choice. Once we click the username and select face (as opposed to PIN or Fingerprint), face login is remembered the next time we open the sign-in options. What Windows can't do is surface the last used provider first it seems.
Is it possible to have multiOTP honor the last-used provider?
Windows maintains a LastLoggedOnProvider value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI recording which credential provider was used for the most recent sign-in. This is currently working even with multiOTP as the default Credential Provider, it just doesn't honor it for what is selected as the default.
The result of this would be per-user and automatic as someone who last signed in with face or PIN gets that first, someone who last used multiOTP gets multiOTP first. That would be the most ideal for hands off configuration, and no single static choice imposed on everyone. Or, maybe a opt-out registry value alongside the existing ones telling multiOTP not to request being the default tile to leave Windows to make its normal selection via the LastLoggedOnProvider?
Most of our staff authenticate with Windows Hello for Business, which is TPM-backed and hardware-bound, and which we accept as a second factor. multiOTP exists for the users who sign in with a username and password and do not want to enrol in company biometrics or use a pin.
Because multiOTP takes the default position, a lot of users who use Windows Hello require some extra clicks for every sign-in and unlock.
Environment
cpus_logon/cpus_unlock/cpus_credui=0e(exclusive)included_providers_id= NGC (Hello PIN){D6886603-9D2F-4EB2-B667-1971041FA96B}; WinBio (fingerprint){BEC09223-B018-416D-A0AC-523971B639F5}; Face{8AF662BF-65A0-4D0A-A540-A338A999D36F}RequireSecurityDevice = 1, forcing TPM usage.Details
The Windows Hello tiles are correctly admitted by multiOTP via
included_providers_idand works as expected. However, the multiOTP tile always has focus when the logon screen appears.How much that impacts a user depends on the Hello method:
So, fingerprint users are fine, but PIN and face users need manual clicks on every sign-in and unlock.
Worth noting that as mentioned above, windows already remembers the choice. Once we click the username and select face (as opposed to PIN or Fingerprint), face login is remembered the next time we open the sign-in options. What Windows can't do is surface the last used provider first it seems.
Is it possible to have multiOTP honor the last-used provider?
Windows maintains a
LastLoggedOnProvidervalue underHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUIrecording which credential provider was used for the most recent sign-in. This is currently working even with multiOTP as the default Credential Provider, it just doesn't honor it for what is selected as the default.The result of this would be per-user and automatic as someone who last signed in with face or PIN gets that first, someone who last used multiOTP gets multiOTP first. That would be the most ideal for hands off configuration, and no single static choice imposed on everyone. Or, maybe a opt-out registry value alongside the existing ones telling multiOTP not to request being the default tile to leave Windows to make its normal selection via the
LastLoggedOnProvider?