Skip navigation
Documentation

Duo Device Health FAQ

Last Updated: November 12th, 2019

Frequently Asked Questions about Duo's Device Health feature and application.

What macOS versions does Duo Device Health support?

The Duo Device Health application supports macOS 10.13 and newer. There are no special cases of macOS to consider. It is not necessary to reinstall the Duo Device Health application after a macOS update.

What Windows versions does Duo Device Health support?

The Duo Device Health application supports only client versions of Windows 10, including Home, Pro, and Enterprise editions. The Duo Device Health application is not supported on other Windows client OS versions or any Windows Server versions.

To simplify the policy selection for all of our customers, while also supporting the most Windows 10 machines, the Windows 10 version policy in the Admin Panel supports a subset of the currently supported builds of Windows 10. As Microsoft support for Home and Pro editions of Windows 10 terminates earlier than the Enterprise edition, the Duo OS policy will support the most recent three Windows 10 builds to capture all Windows devices.

Does Duo Device Health support virtual machines?

Virtual machines may experience their own set of problems, for example, difficulty with unique system identification. Because of these issues, the Duo Device Health application does not officially support Windows or macOS virtual machines.

Can I install the Device Health application via scripted or managed install?

If you'd like to deploy the Device Health application via a scripted install or an endpoint management tool, download the installers here:

macOS: https://dl.duosecurity.com/DuoDeviceHealth-latest.dmg

Windows 10: https://dl.duosecurity.com/DuoDeviceHealth-latest.msi

View checksums for Duo downloads here.

Then, use the following syntax to automate installation:

macOS: Extract the PKG installer from the downloaded DMG file first.

sudo installer -pkg /Volumes/DuoDeviceHealth/Install-DuoDeviceHealth.pkg -target /

Windows 10: Replace the example MSI file name with your actual MSI filename.

msiexec /i DuoDeviceHealth-1.0.0.msi

Does the Duo Device Health application require elevated or administrative privileges?

Duo Device Health installation requires administrator privileges on both Windows and macOS. During installation if the user doesn't have admin rights they'll get prompted to provide credentials of an account that is able to install software on the client.

Once installed, the application should run in the normal user context, without administrator rights. If the application was mistakenly set to run as an administrator on a Windows system, it won't launch or report device status at Duo authentication.

To determine if the Device Health application was configured to run with administrative privileges on Windows (and fix if needed):

  1. Go to the Windows Start Menu and search for Duo Device Health.
  2. In the right-hand pane of the Start Menu's Search results, click on Open File Location.
  3. Right-click on the Duo Device Health shortcut in the file location and click Properties.
  4. Click Advanced on the "Shortcut" tab of the properties window.
  5. Ensure the Run as administrator checkbox is not checked, or clear the selection if it is checked.

Which browsers support Duo Device Health during authentication?

We recommend Google Chrome for the most seamless user experience. Internet Explorer 11, Safari, and Opera are also known to work without issues.

Why do users see repeated prompts to switch apps with Microsoft Edge and Device Health?

Microsoft Edge has a caveat where the user is not presented with an option to remember the choice of allowing the Duo Prompt to communicate with the Duo Device Health application. This can result in a frustrating experience if the user continually closes the Duo Device Health application, as the Duo Prompt will use our fallback method of system URI communication which opens up the dialog that asks if the user intended to switch apps.

Leaving the Duo Device Health application running, even in the background, will prevent most of these dialogs from appearing. There could be cases where embedded web views within other software have issues communicating with the application over HTTPS, which will cause this dialog to appear even while the application is running.

Why might users have a poor experience with Firefox 67+ and Device Health?

Firefox has implemented a feature as of version 67 that limits the rate at which you can attempt to open URLs from links, impacting communication between the Device Health application and Duo's service. If the end user is required to remediate, Duo must to open up to three custom URI links, each of which may be delayed for 10 seconds after the previous link is opened. Additionally. limitations in the way that Firefox examines certificate stores on the local system prevents the Device Health secure web server from functioning as expected. These factors result in poor end users experience when using Firefox.

End users can work around these issues by navigating to the Firefox about:config page, searching for enterprise_roots, double-clicking the security.enterprise_roots.enabled settings row to toggle the value to true.

Firefox version 69 and later make changes that need an exception set in order to trust the Device Health v0.9.x application's self-signed certificate. This is fixed in Device Health v1.0.x, so ensure that users have the latest version.

If you need to add an exception for an older Device Health app version, you can do this in one of two ways:

Add Exception from Browser Warning

  1. Make sure the Duo Device Health app is running. Look for the Duo status icon in the macOS menu bar at the top right of the desktop, or in the Windows 10 system tray at the bottom left of the desktop.

    If the Duo Device Health application isn't running, start it.

  2. Open Firefox and go to https://127.0.0.1:53100/ in a new tab. The page will show a warning which will look like this:

    Firefox Security Warning

  3. Click the Advanced button and scroll down to the warning details about the certificate. Click the Accept the Risk and Continue button to permanently add an exception for the Duo Device Health certificate.

    Firefox Security Warning - Advanced

  4. Close the 127.0.0.1 Firefox tab and navigate to the Duo Prompt. Make sure the Duo Device Health app is running. You should not receive any security warning from Firefox.

Add Exception from Settings

  1. Make sure the Duo Device Health app is running. Look for the Duo status icon in the macOS menu bar at the top right of the desktop, or in the Windows 10 system tray at the bottom left of the desktop.

    If the Duo Device Health application isn't running, start it.

  2. Open Firefox preferences and go to the Privacy & Security panel.

  3. Scroll down to the "Certificates" section. Click View Certificates, then click the Servers tab in the Firefox Certificate Manager, and then click the Add Exception button.

  4. Enter https://127.0.0.1:53100/ in the "Location" field, and then click Get Certificate.

  5. Verify that the Permanently store this exception option is checked, and then click the Confirm Security Exception button.

    Firefox Site Exception

  6. You should now see an entry for "Duo Security, Inc" for the server "127.0.0.1:53100" with a permanent lifetime in the Certificate Manager server list. Click OK then exit the Preferences panel.

  7. Navigate to the Duo Prompt. Make sure the Duo Device Health app is running. You should not receive any security warning from Firefox.

How do I upgrade the Device Health app?

Simply install the new version over the existing one.

How do I uninstall the Device Health app?

Uninstalling the application requires administrator privileges on both Windows and macOS. macOS Users:

  1. Click the Finder icon from the dock

  2. Locate the "Duo Device Health" app in the list of applications.

  3. Right-click the "Duo Device Health" app and select Move to Trash.

  4. Optionally, right-click the Trash icon and select Empty Trash.

Windows 10 users:

  1. Go to StartSettings.

  2. Click Apps & Features.

  3. From the list, select the "Duo Device Health" application and click Uninstall.