Disable: 'Use enhanced anti-spoofing when available' for EnhancedAntiSpoofing This policy setting determines whether enhanced anti-spoofing is configured for devices which support it. If you do not configure this policy setting, users will be able to choose whether or not to use enhanced anti-spoofing on supported devices. If you enable this policy setting, Windows will require all users on the device to use anti-spoofing for facial features, on devices which support it. If you disable this policy setting, enhanced anti-spoofing is turned off for all users on the device and they will be unable to turn it on. Counter Measure: Enable this setting. Potential Impact: Windows will require all users to use anti-spoofing for supported devices.

[enable/disable]

(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsBiometricsFacial FeaturesUse enhanced anti-spoofing when available (2) REG: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftBiometricsFacialFeaturesEnhancedAntiSpoofing