I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up to its promises.
The decision was made to go on-premise with certificate-based authentication (AD2016+ADFS+WindowsCA), and then to test it out from a lateral movement perspective. I registered my laptop and enrolled WH4B with facial recognition and backup pin. Albeit the installation itself was a real PITA (10+ hours to get it running) it now works fine and I can see how face unlock is a nice convenience factor compared to typing in a password.
But security wise? run mimikatz... sekurlsa::logonpasswords... and I still get all the NTLM hashes, kerberos tickets and plaintext passwords. Lateral movement: same as before. nothing has changed.
Did I implement WH4B wrong or is this just the way it is? I followed this Microsoft guide.