Use the following command to delete the existing hello credential certutil.exe -DeleteHelloContainer

You must disable the existing certificate trust policy, deploy the Intune configuration to enable cloud kerberos trust, delete the existing hello credential and sign back in to the device. Migrating from certificate trust has more moving parts. The extra requirement for Hybrid Azure AD joined devices is the device requires line-of-sight to a DC at first logon or it will fall back to using key trust. For Azure AD and Hybrid Azure AD joined devices, simply deploy the Intune configuration to enable cloud kerberos trust and the user will switch to cloud kerberos trust. Migrating from a hybrid key trust model is very simple. What if you are using hybrid key trust and you want to begin kicking the tires on cloud kerberos trust? The answer is simpler than you might think. Pick-up your engineering toolkit and come down the rabbit hole Migrating from other Trust Models Hold tight and get your engineer brain engaged as we equip you with the tools you need to succeed! We love the elegance and simplicity of Cloud Kerberos Trust but in this final post of the mini series we will dive a little deeper and look at some of the mechanics and moving parts to help you understand and troubleshoot your way out of a hole- if you need to. If you missed part 1 of our series, your journey into “Cloud Kerberos Trust” should start here: Simplify Windows Hello for Business SSO with Cloud Kerberos Trust – Part 1 In part 2 we walked through the configuration of Cloud Kerberos Trust for both on-premise infrastructure and clients. We continue our mini series on Windows Hello for Business Cloud Kerberos Trust. Cloud Kerberos Trust under the Microscope.

Windows authenticator app windows 10