Documentation

Duo Authentication for Windows Logon and RDP

Duo integrates with Microsoft Windows client and server operating systems to add two-factor authentication to Remote Desktop and local logons.

Before upgrading your system to Windows 10 you must either update Duo v1.1.8 to a later version or uninstall! See the FAQ for more information.

 

Important Notes

  1. Installing Duo Authentication for Windows Logon adds two-factor authentication to all Windows login attempts, whether via a local console or over RDP, unless you select the “Only prompt for Duo authentication when logging in via RDP” option in the installer. If two-factor is enabled for both RDP and console logons, it may be bypassed by restarting Windows into Safe Mode (e.g. in case of a configuration error). If you wish to protect local console logons with Duo, please see the FAQ for some guidance on securing your Windows installation appropriately.
  2. Duo Authentication for Windows Logon doesn’t support inline self-service enrollment. We recommend using bulk enrollment to send your users unique self-enrollment links via email. Read the enrollment documentation to learn more.
  3. Additional configuration may be required to log in using a Microsoft attached account. See Can I Use Duo with a Microsoft Account? for more information.

Connectivity Requirements

This integration communicates with Duo’s service on TCP port 443. Also, we do not recommend locking down your firewall to individual IP addresses, since these may change over time to maintain our service’s high availability.

System Requirements

Duo Authentication for Windows Logon supports the following operating systems:

  • Windows Vista SP2 and Windows Server 2008 SP2
  • Windows 7 SP1 and Windows Server 2008 R2 SP1
  • Windows 8 and Windows Server 2012
  • Windows 8.1 and Windows Server 2012 R2
  • Windows 10

Duo Authentication for Windows Logon also requires .NET Framework 4.5 or later. If the correct .NET version is not present on your system then Duo setup prompts you to install the .NET Framework.

First Steps

  1. Sign up for a Duo account.

  2. Log in to the Duo Admin Panel and navigate to Applications.

  3. Click Protect an Application and locate Microsoft RDP in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname. (See Getting Started for help.)

  4. Download the Duo Authentication for Windows Logon Installer Package.

Enroll a User

Add your first user to Duo, either manually or using bulk enrollment. The username should match your Windows logon name. Install Duo Mobile and add your account to it so you can use Duo Push. If the user logging in to Windows after Duo is installed does not exist in Duo, the user may not be able to log in.

Run the Installer

Run the Duo Authentication for Windows Logon installer with administrative privileges. Accept the license agreement and enter your integration key, secret key, and API hostname when prompted:

Duo Application Information

Test Your Setup

To test your setup, attempt to log in to your newly-configured system as a user enrolled in Duo.

Windows Login Screen

The Duo authentication prompt appears after you successfully submit your Windows credentials. When auto-push is enabled (the default option), the Duo prompt indicates that a request has been pushed to your phone.

Duo Auto Push

If auto-push is disabled or if you click the Cancel button on the Duo authentication prompt, you can enter the name of any available factor (like “sms” to receive a passcode via text message) to verify your identity to Duo.

Duo Auto Push

Here’s a full list of what you can type into the Duo prompt:

A passcode Log in using a passcode, either generated with Duo Mobile, sent via SMS, generated by your hardware token, or provided by an administrator.
“push” Perform Duo Push authentication
You can use Duo Push if you’ve installed and activated Duo Mobile on your device.
“phone” Perform phone callback authentication
“sms” Send a new batch of SMS passcodes. Your first authentication attempt is denied. You can then authenticate with one of the newly-delivered passcodes.

You can also specify a number after the factor name if you have more than one device enrolled in Duo, like “phone2” to call your second phone or “push2” to send the request to Duo Mobile on your second phone.

Remember: if you find that Duo Authentication for Windows Logon has locked you out of your Windows system (e.g. due to a configuration error), you can reboot into Safe Mode to bypass it.

Advanced Deployment and Configuration using Group Policy

Please see our Duo Authentication for Windows Logon Group Policy documentation.

Troubleshooting

Need some help? Take a look at the Windows Logon Frequently Asked Questions (FAQ) page or try searching our Knowledge Base. For further assistance, contact Support.

Network Diagram

  1. RDP connection or console logon initiated
  2. Primary authentication
  3. Duo Windows Logon credential provider connection established to Duo Security over TCP port 443
  4. Secondary authentication via Duo Security’s service
  5. Duo Windows Logon credential provider receives authentication response
  6. RDP or console session logged in