Disable caching of the Windows Hello for Business credential after sign-in

Removed on: 2025-09-29 · Last confirmed version: 24H2 · Removed policies list

Policy ID: WHFB_DisablePostLogonCredentialCaching
Scope: Computer Configuration
Supported on: At least Windows 10
Source: Administrative Templates (.admx) for Windows 11 2024 Update (24H2) (version 1.0)
Category: Windows Components › Windows Hello for Business

Description

The Windows Hello for Business credential is cached after sign-in to allow certain security related applications to use the credential silently to not disrupt the user experience. Enable this policy to turn this off, removing the cache so user input is explicitly necessary.

Registry

DisablePostLogonCredentialCaching

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\PassportForWork Current key

Enabled value: 1
Disabled value: 0

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork]

; Options (use only one)
; Enabled
"DisablePostLogonCredentialCaching"=dword:00000001
; Disabled
"DisablePostLogonCredentialCaching"=dword:00000000

CMD

:: Options (use only one)

:: Enabled
reg add "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork" /v "DisablePostLogonCredentialCaching" /t REG_DWORD /d 1 /f
:: Disabled
reg add "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork" /v "DisablePostLogonCredentialCaching" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork' -Force | Out-Null

# Options (use only one)
# Enabled
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork' -Name 'DisablePostLogonCredentialCaching' -PropertyType DWord -Value 1 -Force | Out-Null
# Disabled
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork' -Name 'DisablePostLogonCredentialCaching' -PropertyType DWord -Value 0 -Force | Out-Null