1

I have an Azure AD joined system set up to log on using FIDO2 tokens. With that token I am able to logon as well as unlock the Windows 10 computer so I know that the token is registered and working.

When I try to authenticate a user's YubiKey using CredUIPromptForWindowsCredentials I do not see the "FIDO security key" as one of the options.

On the same system, when a fingerprint scanner is attached and setup, I see the option to authenticate the fingerprint. PIN and Windows Smart Card authentication is also working.

Anyone have any idea why "FIDO security key" does not appear as an option on the Security Dialog that appears when calling CredUIPromptForWindowsCredentials but does appear and work on the Windows Logon and Unlock screens?

Edz1o
  • 21
  • 3

1 Answers1

0

As of Windows 10 1903 you can only access FIDO devices through Windows Hello unless running with administrator permissions. I can't find anymore the original Microsoft changelog talking about this, I did read it some time ago but I think it got removed, but this issue discuss this.

That explains why it shows on the login screen which is running under the SYSTEM account but not when using CredUIPromptForWindowsCredentials which is running in CREDUI mode, that is under the user account.

So you either have to correctly configure Windows Hello to use FIDO devices, or if you are developing your own credential provider you will have to use Windows Hello API.

Nehluxhes
  • 166
  • 2
  • 9
  • I have tried running the program under an elevated user account and under SYSTEM. I have Windows Hello Face, Windows Hello Fingerprint, Windows Hello PIN as well as the Security Key enabled and configured. When logging on or unlocking the system I am presented with all those options. However, when calling CredUIPromptForWindowsCredentials from my program, I am presented with all of the above options with the exception of the Security Key. Is it possible to present the Security Key option in the "Windows Security" dialog that appears when calling CredUIPromptForWindowsCredentials? – Edz1o Dec 18 '22 at 22:40