Windows login multi-factor authentication

Double the protection against security breaches

With the sophistication of security breaches increasing every day, relying only on usernames and passwords to secure users' accounts is no longer an option. It has become necessary to add additional layers of security to filter out unauthorized users. Two-factor authentication (2FA) and multi-factor authentication (MFA)—methods in which user identities are verified with additional authentication methods like biometrics, Google Authenticator, and YubiKey—make this possible.

Logging in to Windows with ADSelfService Plus' MFA feature

With ADSelfService Plus' MFA for Machine Logins feature enabled, users have to authenticate themselves in two successive stages to access their Windows machines. The first level of authentication is through the usual Windows Active Directory credentials. The second level of authentication can be through one of the following:

Implementing two-factor authentication (2FA) or MFA during Windows logins greatly reduces the risk to sensitive data, even in cases where passwords are compromised. This means that even if unauthorized users gain access to a user's password, they still need access to the user's phone or email to get the verification code.

As part of Windows MFA option in ADSelfService Plus, you can enable SMS/email-based OTP, Google Authenticator, YubiKey, biometric, and Duo Security as an additional authentication step. These MFA methods are unique to each user, and hence, are safer than just using passwords.

How MFA for Windows logons works

Multi-factor authentication for remote desktops

When Windows logon 2FA or MFA is enabled, it adds multiple authentication methods to all local and remote Windows login attempts. MFA is even more important for users trying to access an organization's internal resources remotely.

Virtual private network solutions facilitate remote access but are susceptible to data breaches. ADSelfService Plus offers MFA for VPNs to strengthen VPN security. In addition to the username and password provided to the VPN server by the user, users will need to undergo additional factors of authentication, as configured by the administrator, to be able to access their company's resources.

How 2FA or MFA for Remote Desktop (RDP) works

Weak passwords, frail encryption mechanisms, and lack of access controls are few major vulnerabilities that make RDP connections a common target for malware and ransomware attacks. With organizations adopting hybrid work environment, RDP connections need to be secured thoroughly. In RDP MFA or VPN MFA, we can define the terms under which a particular remote setup goes through 2FA or MFA. For example, RDPs that pass through a particular gateway. The workings of 2FA or MFA for remote desktop are very similar to the local Windows/machine logon methods, except the second or multiple factors of authentication are triggered during the RD gateway connection.

Customize Windows 2FA or MFA for your organization

Administrators can customize ADSelfService Plus' MFA features based on their organization's needs. Some of the different ways in which MFA can be customized are listed below:

Implementing MFA for RDP across various device types and operating systems

ADSelfService Plus supports remote desktop multi-factor authentication for the following operating systems,

Other endpoints supported:

Here's how it works: