Prevent disabling passkeys on Windows

I recently read an article from Dr. Emin Huseynov about the toggle in Windows settings that disables passkeys for every user.

While there can be specific circumstances where an organization may intentionally disable passkey usage, I – passkey fan – want to make sure it is enabled.

I did not find any official solution to restrict disabling passkeys, so I share my approach.

TL;DR

• The toggle state can be queried via registry
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
    CapabilityAccessManager\ConsentStore\passkeys\Value (REG_SZ) = Deny / Allow
• When you slide the toggle to on, the following command kicks in:
  • “C:\Windows\system32\SystemSettingsAdminFlows.exe” SetCamSystemGlobal passkeys 1
• We know how to detect the drift and how to remediate, it’s up to our favorite device management solution to handle it (I’m sharing my first Intune remediation script – but don’t worry SCCM, you will always be my favorite)

Note: It is not enough to set the registry value to “Allow”. The command above invokes “svchost.exe -k osprivacy -p -s camsvc” which applies the relevant settings.

I guess I summarized everything so let’s cut to the Intune remediation.

Detection script:

if ((Get-ItemPropertyValue -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\passkeys -Name "Value") -eq "Allow"){exit 0}else{exit 1}

Remediation script:

cmd /c "C:\Windows\system32\SystemSettingsAdminFlows.exe" SetCamSystemGlobal passkeys 1

Create the Intune setting:

Upload the detection and remediation scripts. As per my experience, this requires admin privileges so make sure “Run this script using the logged-on credentials” is set to “No” and “Run script in 64-bit PowerShell” is set to “Yes” (registry detection would fail because of the 32bit redirection)

I guess this can be deployed to All devices, but for testing purposes I deployed it to a dedicated group with Hourly schedule:

After “enforcing” the remediation, the issue is now fixed:

Happy passkeying!