Skip links

Duo Authentication for Windows Logon and RDP

 

Why 2FA is needed for windows logon?

Today, there are a lot of cyber-attack attempts and threats from hackers. Most businesses use computers for their work and it is critical to keep your computers and data safe. You can add a duo security product for computer logon as a second-factor authentication. With this, even if your computer login credentials are compromised, you can still keep your data safe since hackers should go over one more security layer which is your duo 2FA.

 

What is Duo Authentication for Windows Logon?

Duo Authentication for Windows Logon adds Duo two-factor authentication to Windows desktop and server logins, both at the local console and incoming Remote Desktop (RDP) connections. Starting with version 4.1.0, you can optionally require two-factor authentication for credentialed User Access Control (UAC) elevation requests (e.g. Right-click + “Run as administrator”), depending on your organization’s Windows UAC configuration.

 

How to install and activate the Duo Authentication

1. Make sure your workstation matches the system requirements shown below

System Requirements

Duo Authentication for Windows Logon supports both client and server operating systems.

Clients:

  • Windows 8.1
  • Windows 10 (as of v1.1.8)

Servers (GUI and core installs):

  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016 (as of v2.1.0)
  • Windows Server 2019 (as of v4.0.0)

Ensure your system’s time is correct before installing Duo.

2. If you already have duo product, proceed to step 3. If not, follow the instruction here.

3. Click here to download the Duo Authentication for Windows Logon installer package.

If your workstation belongs to your company domain, it will request elevated permission for downloading. Please contact your IT department.

4. Sign in to the duo security admin portal, then go to Applications -> Protect an Application -> Search for  RDP -> Click Protect for Microsoft RDP.

5. Go to Applications -> Microsoft RDP.

These details will be used when we configure the Duo Authentication for Windows Logon installer.

 

6. Run the Duo Authentication for Windows Logon installer package downloaded on step 3.

 

a. Click on Next.

b. Copy API Hostname shown on step 5 and paste it in, then click Next.

c. Copy Integration Key & Secret Key shown on step 5 and paste it in, then click Next.

d. Keep the settings as default and click Next.

e. Keep the settings as default and click Next.

f. Keep the settings as default and click Next.

 

What is Password Protected UAC prompt?

When a user tries to do tasks that only system administrators are allowed to do, Windows will require an administrative account credential for security purposes. If you want to enable the duo two-factor authentication for password-protected UAC (User Access Control) prompts, click on Enable UAC Elevation Protection.

 

Verify the Duo 2FA for Windows Logon and RDP

1. Sign out from Windows and try signing in. You will get this prompt when signing in.

2. You will get a login request on your phone. Click on Approve.

 

You are now good to go!

 

Troubleshooting

Why do I not get notifications on the duo mobile app when signing in?

Make sure you have installed the duo mobile app on your phone first. You can simply go to App Store or Google Play Store, search for Duo Mobile, and install the software. If you already installed the software, but you still don’t get the notification, you should check the 2FA device on the duo security admin portal.

Go to 2FA devices -> Your device -> Device Info

This problem is mostly caused since you didn’t activate duo mobile from device info. Try it out after activating the duo mobile. If it still doesn’t work, please visit here for more information.

 

Why can’t I sign in and get this error message?

If you are not able to sign in and get the error message shown below, you probably didn’t add an alias for username on the duo security admin portal.

Go to Users -> Your name -> Username Aliases, then add your computer login username there.

 

 

For more information please contact us

Phone: (604) 757-9823

Email: [email protected]

Website: https://turboitsolutions.com/contact-us/

For more IT tips & information, please visit these blogs

 

 

SUSPICIOUS EMAIL MANAGEMENT

Did you know that Canadians spend a lot of time checking email while they are using a desktop, a laptop, and mobile devices? According to a survey conducted by CIRA,  when people are using a desktop or a laptop, 44 percent catch up on email. When using a mobile device like a smartphone, 42 percent say they spend time on email, which is the same amount as they use social media.

 

SECURITY FEATURE YOU MUST HAVE: STRONG PASSWORDS AND MULTI-FACTOR AUTHENTICATION

Thanks to modern technology, we use computing devices, such as desktops, laptops, smartphones, tablets, and smartwatches anywhere and anytime. Mostly, these devices connect with other computing devices through the Internet to share information and utilize useful features like mobile banking and online shopping. All of these devices are potentially vulnerable to misuse by hackers, so it is necessary for the users to have strong passwords.