Windows Hello login delay on lenovo system

Products

• Endpoint Protection

Issue/Introduction

On Lenovo ThinkPad devices, a delay of up to 3 seconds is observed during Windows Hello login (facial recognition or fingerprint) when Symantec Endpoint Protection (SEP) 14.3 RU7 through 14.4.x is installed.

• Windows Hello login takes significantly longer (up to 3 seconds) than manual credential entry.
• No delay is observed when logging in with a password or PIN.

Environment

SEP  14.3 RU7 through 14.4.x 

Cause

This behavior is working as designed. The SEP Auto-Protect, SONAR, and ADC drivers monitor the camera driver initialization process during biometric authentication, which introduces a minor latency on specific Lenovo hardware configurations.

Resolution

There are two solutions any one of this can be applied to reduce the Latency 

1. Configure the Virus and Spyware policy, Auto-Protect advance options, under Startup and Shutdown Loads Auto-Protect when the SEP client starts.
Refer: Auto-Protect: Advanced

2. Configure the File and folder exception for the Camera driver repository and files

• Add a File Exception for: C:\Windows\system32\drivers\ksthunk.sys
• Add a Folder Exception for the camera driver repository: C:\Windows\System32\DriverStore\FileRepository\iacamera64.inf_amd64_6493530e432d8528\

Note: Camera drivers may be updated to new versions by the manufacturer. Work with Lenovo support to verify exact camera driver file names and locations for your specific model. Refer to Configuring Exceptions in Endpoint Protection Manager for detailed steps.