Free EditionWith ADSelfService Plus, admins can use MFA to harden security for Windows endpoints during interactive logons, UAC, machine unlocks, and RDP connections.
Benefits of MFA for Windows connections
Based on the level of security needed, logins to and from Windows machines can be secured in two ways: user-centric MFA, and machine-centric MFA. The table below details the differences between these settings.
| User-centric MFA | Machine-centric MFA |
| User-centric MFA is applied to users based on the policies configured for them. | Machine-centric MFA protects sensitive machines with MFA, and takes precedence over policy-based (user-centric) MFA. |
| User-centric MFA prompts users who access any machine on the domain for MFA. | Machine-centric MFA ensures that any user accessing the machine will be prompted for MFA. |
| You can choose to allow users who are not enrolled to skip MFA during logins to a machine and other connections made from within the machine. | You can use this setting to mandate MFA during logins to the machine as well as other connections made from within the machine, even if users' policies (user-centric MFA) allow them to skip machine MFA for those scenarios. |
This setting can be applied to
|
This setting mandates MFA on specific machines regardless of the enrollment status of the user attempting access. |
You can use these methods separately or together to achieve the optimal level of security required by your organization. The authentication methods prompted for both user-centric and machine-centric MFA depend on the authenticators assigned to the user according to their policy.
Note: Security hardening with device-based MFA for Windows requires the Professional edition of ADSelfService Plus with Endpoint MFA. Learn more
To apply machine login MFA as part of users' self-service policies,
To protect critical or sensitive Windows machines with MFA irrespective of whether the user is enrolled for MFA or not,
After configuring machine-based MFA for Windows machines, you can enable Offline MFA to prevent getting locked out of the machine in situations when the Windows machine is offline or cannot reach the ADSelfService Plus server. Learn more
That's it! Now you know how to protect your Windows endpoints with MFA and harden your organization's overall security.
Like this tip? Explore additional ways to optimize ADSelfService Plus by visiting our knowledge base.
Need further assistance? Fill this form, and we'll contact you rightaway.
Allow Active Directory users to self-service their password resets and account unlock tasks, freeing them from lengthy help desk calls.
Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications using their Active Directory credentials.
Intimate Active Directory users of their impending password and account expiry via email and SMS notifications.
Synchronize Windows Active Directory user passwords and account changes across multiple systems automatically, including Microsoft 365, Google Workspace, IBM iSeries, and more.
Strong passwords resist various hacking threats. Enforce Active Directory users to adhere to compliant passwords by displaying password complexity requirements.
Enable Active Directory users to update their latest information themselves. Quick search features help admins scout for information using search keys like contact numbers.
