Users with blank passwords may not login after Duo Authentication installation.

Windows users must have passwords to log in to the computer.

See Can I Use Duo with a Microsoft Account? for more information.

Additional configuration may be required to log in using a Microsoft attached account.

If you wish to protect local console logons with Duo, please see the FAQ for some guidance on securing your Windows installation appropriately. If two-factor is enabled for both RDP and console logons, it may be bypassed by restarting Windows into Safe Mode (e.g.

Installing Duo Authentication for Windows Logon adds two-factor authentication to all interactive user Windows login attempts, whether via a local console or over RDP, unless you select the 'Only prompt for Duo authentication when logging in via RDP' option in the installer.

Please review all these compatibility and installation notes before proceeding.

Pre-Logon Access Providers (PLAPs) such as Windows Always On VPN.

Log on as a Service, Log on as Batch, Scheduled Tasks, drive mappings, etc.)

PowerShell 'Enter-PsSession' or 'Invoke-Command' cmdlets.

Shift + right-click 'Run as different user'.

Right-click + 'Run as administrator') in v4.1.0 and laterĭuo's Windows Logon client does not add a secondary authentication prompt to the following logon types:

Credentialed User Access Control (UAC) elevation requests (e.g.Logins at the local console and/or incoming Remote Desktop (RDP) connections.I'm not sure if there's a way to restrict that or not, so that's where i'm currently stuck.Be sure to read through these instructions before you download and install Duo for Windows Logon.ĭuo Authentication for Windows Logon adds Duo two-factor authentication to these Windows and Windows Server logon scenarios:

In order for that to be adequate though, I then need to be able to prevent RSAT connections to Active Directory. What I think the only viable solution would be is to set up MFA for access to any Domain Controller in the domain. I'm not aware of a way to set up any MFA for admin access to Active Directory itself, but I'm all ears if someone knows of a way. Multi-factor authentication is required for the following, including such access provided to 3rd party service providers:Īll internal & remote admin access to directory services (active directory, LDAP, etc.). I have received a 'cyber security attestation' document from a major insurance provider and must be able to say yes to all of the items on it as a baseline to receive a policy. I've run into a puzzler and I'm hoping someone can give me a tip on how to solve this.

Mfa for windows server login