Introduction

I recently did a tweet about doing a toast notification to lure end-users into enrolling their device with Windows Hello for Business voluntarily.

• Find the tweet here: https://twitter.com/mwbengtsson/status/1179343506898329601
• And another WHfB inspirational tweet here: https://twitter.com/mwbengtsson/status/1182346707302076416

Prior to doing the tweet, I found my self wrestling with Powershell and a way to locate devices not enrolled into WHfB yet. Seeing I only wanted to nag people not enrolled yet, this was a requirement for the entire process.

So this post is a little something on both the actual toast notification, but also on how I ended up locating devices not enrolled into WHfB yet using a Compliance Baseline in ConfigMgr.

Powershell

As mentioned, I ended up creating a Powershell script which will return either True or False, indicating either successful enrollment or missing enrollment for the currently logged on user.

• Credit where due: Niall Brady pointed me in the direction of the registry key used in the script. I was originally looking into traversing WHfB event logs, but that quickly turned out useless as they get overwritten.

The script does following in headlines:

• Loads registry keys and values for the PIN credential provider
• Looks up the logged on user’s SID in local Active Directory if any AD is available
  • Compares the SID in registry to the logged on user’s SID
    • If the logged on user’s SID exists in registry for the PIN provider, see if the PIN credential provider is used
      • Returns True if it does
      • Returns False if it doesn’t
• If no local Active Directory is available, continue looking for the logged on user’s SID in WMI
  • Then do the same as above

Download

https://gallery.technet.microsoft.com/Windows-Hello-for-Business-be351268

Configuration Manager

So how does one use this script with SCCM? I have included 2 scripts doing practically the same in the download. The script tagged with SCCM_CI is the one I suggest you use, as this has been stripped for comments and other unnecessary cmdlets.

The other script is the initial script, containing commenting and write-verbose cmdlets for easing of the understanding.

• Get-WHFBCompliance.ps1
• Get-WHFBCompliance_SCCM_CI.ps1

Create a new Configuration Item with a Setting similar to the below illustration. Paste in the Powershell script from the download.

The important part here is, that the CI runs in the current users context, as we try to look up the users SID in Active Directory.

Also, create a Compliance Rule similar to below and complete the Configuration Item.

Attach the Configuration Item to a Configuration Baseline and deploy it.

Now, the deployment of the Configuration Baseline gives us some options to create additional collections. See below illustration.

Go ahead and create collections for both Compliant and Non-compliant.

• Compliant = The user is enrolled into Windows Hello for Business
• Non-compliant = The user is NOT enrolled into Windows Hello for Business

The collections created above can now be used to target the actual Toast Notification. See below for inspiration.

Toast Notification

The toast notification is obviously created with my Windows 10 Toast Notification Script found here: https://www.imab.dk/windows-10-toast-notification-script/

Configuring the script to use with Windows Hello for Business is straightforward and just requires you to turn off all the built in features like so:

<Feature Name=”UpgradeOS” Enabled=”False” />
<Feature Name=”PendingRebootUptime” Enabled=”False” />
<Feature Name=”PendingRebootCheck” Enabled=”False” />
<Feature Name=”ADPasswordExpiration” Enabled=”False” />

Include some relevant images and text and you are set to deploy the script to the collection consisting of devices not yet enrolled into Windows Hello for Business.

HOT TIP: Make the toast notification action button redirect users directly into the WHfB enrollment page using this: <Option Name=”Action” Value=”ms-settings:signinoptions” />

More possible settings actions here: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app#accounts

ENJOY 🙂