Authentication with Windows Hello for Business

If you are enrolled with Windows Hello for Business on the client system, Windows Hello for Business with certificate authentication is supported for the Log In as Current User feature on Horizon Client for Windows. Windows Hello for Business is supported only for Horizon Blast display protocol.

Note: If True SSO is enabled on Horizon Connection Server, it will take precedence over Windows Hello for Business.

Prerequisites

Your system must meet the following requirements for authentication with Windows Hello for Business:

• Log In as Current User must be enabled on the broker and on Horizon Client.
• Your client system must be enrolled with a Windows Hello for Business deployment which supports Certificate Trust. For details on supported deployment models including Certificate Trust, see https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-guide.
• You must be logged in to the system where Horizon Client is installed using Windows Hello for Business credentials.
• If Unified Access Gateway is used, it must be in Pass-through mode.
• System hardware requirements are as follows:
  • Horizon Connection Server and Horizon Agent version 8.6 or later.
  • Horizon Client for Windows version 2206 or later.
  • Windows Server 2019 or later if Horizon Agent is installed on Windows server.

Note: Starting with Horizon 8 version 2406, Windows Hello for Business is supported for remote desktop Windows machines running in Protected Process Mode. The Protected Process Mode is a security feature that protects critical system processes, such as Local Security Authority Subsystem Service (LSASS), from tampering and unauthorized access.

Use Cases Not Supported

Windows Hello for Business is not supported for the following scenarios:

• Unified Access Gateway in non-pass through mode
• Unified Access Gateway with two factor authentication or SAML enabled
• Desktop Apps
• Environment where Horizon Agent and Horizon Client are installed on the same system and used in a nested environment
• Direct Agent Connect
• The client system (where Horizon Client is being launched) is enrolled using Windows Hello for Business using any other method except Certificate trust.

Share Windows Hello for Business Certificate with Third Party Applications

You can use the CertStoreIntercept library to share the Windows Hello For Business certificate used for SSO with third party applications for user authentication. This library can be configured via the Windows Hello For Business Certificate Redirection GPO setting. For more information, see View Agent Configuration ADMX Template Settings in the Horizon Remote Desktop Features and GPOs document.

Logging

Logging for Windows Hello for Business certificate redirection is disabled by default. Administrators can enable logging via registry key HKM\SOFTWARE\VDM\Whfb\IsCertInterceptLoggerEnabled.

On the Horizon Agent, Windows Hello for Business logs are saved in the Agent debug logs. On the Horizon Client, they are saved in the debug log file in %LOCALAPPDATA%\VDM\logs.

Turn Off Support for Windows Hello for Business Authentication

The client GPO setting Disable usage of Windows Hello for Business credentials allows administrators to turn off support for Windows Hello for Business credentials when using the Log In as Current User feature. For more information, see Security Settings for Client GPOs.

The following table describes the login experience for various authentication scenarios when support for Windows Hello for Business authentication is turned off.