Detections
Analytics

WN11-CC-000195 - Enhanced anti-spoofing for facial recognition must be enabled on Windows 11.

Information

Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.

Note: A different registry location is needed when systems are managed by Intune versus GPO.

Solution

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> 'Configure enhanced anti-spoofing' to 'Enabled'.

For Intune-managed systems:

Revise the Intune policy to enable enhanced anti-spoofing for Facial Features.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253389r1256673_rule, STIG-ID|WN11-CC-000195, Vuln-ID|V-253389

Plugin: Windows

Control ID: a2738521df3cf56a3a68841a40811ee39754a65d8adb21e270188f9684a9b919