Fix Windows Hello Fingerprint After an Update

Short version: if fingerprint sign-in worked before an update and now says "This option is currently unavailable" or "We couldn't find a fingerprint scanner compatible with Windows Hello Fingerprint," work through these in order — driver reinstall, biometric service restart, then Enhanced Sign-in Security (ESS) compatibility — before you touch the registry or reinstall Windows. Most cases resolve in the first two steps. The third step, ESS, is the one almost nobody checks and the one that explains most of the "my hardware is fine but Windows won't use it" cases on 24H2 and 25H2.

Step 1: Confirm the sensor is actually visible to Windows

Open Device Manager and expand Biometric devices. If your fingerprint reader isn't listed there at all, or shows a yellow warning icon, that's your starting point —Windows Hello can't use a device it can't see, regardless of anything else you try.

Right-click the fingerprint entry and choose Uninstall device. Don't check "delete the driver software" on the first attempt —you want Windows to try reinstalling automatically first.
Restart the PC. Windows will attempt to reinstall the driver on boot.
Go to Settings > Accounts > Sign-in options and check whether Fingerprint recognition is available again.

If it's still missing or broken, go back to Device Manager, right-click the sensor, and this time choose Update driver > Browse my computer for drivers > Let me pick from a list of available drivers. Sometimes there are two driver entries and Windows Update pointed the device at the wrong one after the update; the specific vendor driver (Synaptics, Goodix, ELAN, and similar names are the common ones) works where the generic one doesn't. If nothing helpful shows up in that list, get the exact driver package from your laptop manufacturer's support site for your specific model number —not a generic "fingerprint driver" download, which won't match your sensor's firmware.

Step 2: Restart the Windows Biometric Service

This is Microsoft's own documented step, not a forum trick. Per Microsoft's official Windows Hello Enhanced Sign-in Security troubleshooting guidance, if the driver reinstall doesn't fix it, remove your PIN first (Settings > Accounts > Sign-in options > PIN > Remove), then run this from an elevated Command Prompt:

net stop wbiosrvc
net start wbiosrvc

Removing the PIN before restarting the service matters Microsoft specifically calls this out in its own sequence, and skipping it is a common reason people report "I restarted the service and nothing changed." After the service restarts, re-add your PIN, then test fingerprint sign-in again.

Step 3: Check whether Enhanced Sign-in Security is the actual blocker

This is the step that resolves the "device manager shows everything is fine but Hello still refuses it" cases, and it's specific to Windows 11, version 24H2 and later. Enhanced Sign-in Security (ESS) isolates biometric matching inside Virtualization Based Security (VBS) and the TPM, and it only works with sensors built to support it match-on-chip fingerprint readers with a manufacturer-burned certificate. If your sensor isn't ESS-capable, or your system's ESS state changed after the update, Windows will refuse to enumerate the device rather than fall back to a less-secure mode automatically.

Confirm this is happening before you change anything:

Open System Information (msinfo32) and check that Virtualization Based Security shows as Running under System Summary.
Under System Information > Software Environment > Running Tasks, confirm bioiso.exe and ngciso.exe are present. If either check fails, the system may no longer meet ESS requirements the way it did before the update.
Open Event Viewer > Applications and Services Logs > Microsoft > Windows > Biometrics > Operational, and look for event ID 1108. It tells you whether your sensor loaded in an isolated Virtual Secure Mode process (ESS on) or a regular System process (ESS off).

If you're using a third-party or external USB fingerprint reader rather than a built-in one, Microsoft's own support guidance states plainly that ESS is not supported for external camera modules, and many external fingerprint readers aren't ESS-capable either. If ESS got turned on for your account (often the default on Copilot+ PCs) after your device's first ESS-capable sensor was enrolled, your external reader may now be blocked entirely, not malfunctioning.

The fix, per Microsoft, is in Settings > Accounts > Sign-in options > Additional settings: turn the Enhanced sign-in security toggle off if you need to use a non-ESS sensor. Understand the tradeoff before you do this turning it off removes existing ESS enrollments and credentials like passkeys, which you'll need to set up again, and it does drop your biometric data out of the hardware-isolated protection. It's the right call if your only working sensor is non-ESS; it's not something to toggle reflexively.

Symptom, confirming check, and fix

What you're seeing	How to confirm it	Fix
Sensor missing or warning icon in Device Manager	Biometric devices section is empty or shows a yellow triangle	Uninstall device, restart, let Windows reinstall; if that fails, install the OEM driver from the manufacturer's site by exact model
Driver shows fine, but sign-in still fails after driver reinstall	No warning icon, but Settings still shows fingerprint as unavailable	Remove PIN, run `net stop wbiosrvc && net start wbiosrvc`, re-add PIN, retest
Everything above checks out, external/third-party reader still blocked	Event Viewer event 1108 shows the sensor isolated in a System process (non-ESS) while Sign-in options shows Enhanced sign-in security as On	Settings > Accounts > Sign-in options > Additional settings > turn off Enhanced sign-in security
VBS or biometric isolation processes missing	`msinfo32` shows VBS not running, or `bioiso.exe`/`ngciso.exe` absent from Running Tasks	System no longer meets ESS requirements post-update; file a Feedback Hub report and use PIN/password until resolved
Fingerprint worked yesterday, fails today after reboot specifically	Device Manager > Biometric device > Properties > Power Management tab shows "Allow the computer to turn off this device" checked	Uncheck that option so the sensor isn't powered down between sessions

Don't do this first

Don't jump to deleting the NGC credential folder or clearing the entire fingerprint database before working through the three steps above that wipes every enrolled fingerprint and PIN relationship on the device, and it's a fix of last resort for corrupted credential data, not a first move for a driver or ESS mismatch. Don't switch from a Microsoft account to a local account purely to "test" fingerprint sign-in either, unless you've already ruled out the driver and ESS causes it's a real diagnostic step in some threads, but it disrupts far more of your setup than the actual fix usually requires.

Checklist

Device Manager > Biometric devices: sensor present, no warning icon
PIN removed, biometric service restarted, PIN re-added
VBS running and bioiso.exe/ngciso.exe present if this is a 24H2+ system
Event Viewer event 1108 checked to see actual ESS state, not just assumed state
ESS toggle in Sign-in options matches what your specific sensor supports

If fingerprint sign-in still won't come back after all of this, the next reasonable step is a repair install using current Windows 11 installation media, which resets corrupted system components without removing files or apps worth doing before you consider a clean reinstall.