Enhancing Security in Windows 11: How to Enable Enhanced Sign-in Security (ESS)

As the digital world continues to evolve, security becomes a paramount concern for users, especially those operating within the Microsoft ecosystem. In the latest update, Windows 11 introduces Enhanced Sign-in Security (ESS), a feature aimed at fortifying the sign-in process for its users. This article delves into what ESS is, how it works, and how you can enable it on your Windows 11 device.

Understanding Enhanced Sign-in Security (ESS)​

Enhanced Sign-in Security is a sophisticated layer of security designed to enhance the traditional sign-in methods in Windows, specifically through Windows Hello. Windows Hello is Microsoft's biometric sign-in feature that allows users to use facial recognition or fingerprint scans to access their devices.

The Core of ESS​

At its core, ESS is built upon Virtualization-Based Security (VBS), which creates a secure environment that helps protect the integrity of your credentials. This extra layer of security is particularly critical when it comes to managing sensitive data, as it works alongside traditional biometric systems like facial recognition and fingerprint sensors to create a more secure authentication path.

Hardware Requirements​

To leverage the benefits of ESS, certain hardware prerequisites must be met:

• VBS (Virtualization-Based Security): Essential for creating isolated secure environments.
• TPM 2.0 (Trusted Platform Module): A hardware-based security feature that cryptographically protects credentials.
• Device Guard Enablement: Ensures that only trusted applications run on the machine.
• Compatible Biometric Drivers: Drivers that support ESS must be installed.
• Secure Devices (SDEV) ACPI Table: Your hardware manufacturer must ensure the firmware is appropriately configured.

How to Enable Enhanced Sign-in Security (ESS)​

Enabling ESS on your Windows 11 device involves a straightforward process. Here’s how you can do it:

1. Open Windows Settings: Press Win + I to open the settings panel.
2. Navigate to Accounts: Select Accounts and then click on Sign-in options.
3. Access Additional Settings: Look for Additional settings within the Sign-in options.
4. Enable External Sign-in Options: Find the option titled Sign-in with an external camera or fingerprint reader. Toggle this option to turn it ON.

Registry Method for Enabling ESS​

If you'd like to dive into your system's registry to enable ESS, you can do it through the following steps:

1. Open Registry Editor: Type regedit in the Windows search box and hit Enter.
2. Navigate to the Path: Go to the following registry path:
   
   Code:

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinBio

3. Edit the Registry Key: Look for the key named SupportPeripheralsWithEnhancedSignInSecurity. If it doesn't exist, create a new DWORD (32-bit) value. Set its value to 0 to enable ESS and 1 to disable it.
4. Restart Your Device: Ensure to restart your device for changes to take effect.

Verifying ESS is Enabled​

After enabling ESS, you might want to confirm that it's functioning correctly. You can do this via the Event Viewer:

1. Open the Event Viewer (search for it in the Windows search bar).
2. Navigate to:
   
   Code:

    Applications and Services Logs > Microsoft > Windows > Biometrics > Operational

3. Look for Event ID 1108; if you see this, your ESS is enabled and operating correctly. If not, check your drivers and hardware compatibility.

Turning Off Enhanced Sign-in Security​

Should you find yourself requiring the old sign-in methods (or if your device doesn't meet the hardware requirements), turning off ESS is just as simple:

1. Press Win + I to open Settings.
2. Go to Accounts > Sign-in options.
3. Disable the Sign-in with an external camera or fingerprint reader toggle.

Broader Implications for Windows Users​

The introduction of ESS is part of Microsoft’s broader strategy to enhance security across its platforms. With increasing cybersecurity threats, this feature not only enhances user confidence but also aligns with industry standards for data protection.
This move towards integrating comprehensive security measures reflects an ongoing commitment to user privacy and protection. As users adapt to these features, they are encouraged to be proactive about their security settings.
In conclusion, Enhanced Sign-in Security (ESS) is a noteworthy feature for users of Windows 11, especially for those keen on maintaining stringent security protocols. By understanding how to enable and manage ESS, as well as recognizing its system requirements, users can better protect their personal and sensitive information in today’s digital landscape.
Source: The Windows Club Enable Enhanced Sign-in Security (ESS) in Windows 11