Detections
Analytics

WN11-CC-000195 - Enhanced anti-spoofing for facial recognition must be enabled on Windows 11.

Information

Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.

Note: A different registry location is needed when systems are managed by Intune versus GPO.

Solution

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> 'Configure enhanced anti-spoofing' to 'Enabled'.

For Intune-managed systems:

Revise the Intune policy to enable enhanced anti-spoofing for Facial Features.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R11_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253389r1268251_rule, STIG-ID|WN11-CC-000195, Vuln-ID|V-253389

Plugin: Windows

Control ID: e514e831fd3c8c1caaa1e975ef3e5627632f016cb955c10cc16d8bc18608e635