Skip navigation
Duo Blog
Admin Login
Documentation

Duo Authentication for Windows Logon and RDP - Release Notes

Last Updated: May 1st, 2023

Contents

Related

Duo integrates with Microsoft Windows client and server operating systems to add two-factor authentication to Remote Desktop and local logons.

Download the current release from the Checksums and Downloads page.

Version 4.2.2 - March 15, 2023

  • Corrects an issue in Duo Offline Access for Windows which allowed "Windows Offline" login passcodes to be reused or replayed under certain conditions (CVE-2023-20123; Cisco Security Advisory).

Version 4.2.1 - November 22, 2022

  • Corrects an issue where an enrolled Windows Offline user would be deprovisioned from offline access if there was a network disruption during online login.

Version 4.2.0 - September 23, 2021

  • Introduces remembered devices for local Windows logins. The Remembered Devices policy for Duo Essentials, Advantage, and Premier plan customers now includes settings for Windows Logon. Remembering the device during online authentication creates a trusted session, letting users skip Duo two-factor authentication for the lifetime of the session.
  • Adds the hostname of the system where Duo for Windows Logon is installed to Duo Mobile push requests and the Windows logon authentication type (Local, RDP, UAC) to Duo Push request notifications.
  • Adds support for Windows 11 and Windows Server 2022.
  • Bug fixes.

Version 4.1.3 - November 2, 2020

  • Fixes an issue with Duo Windows Logon installer that may cause a MSI self-repair and subsequent "Installation stopped" error from Duo Windows Logon Installer. Customers upgrading from 4.1.2 may still experience unexpected MSI self repairs during installation. Refer to Duo KB article 6462 for additional remediation steps.

Version 4.1.2 - October 14, 2020

  • Addresses an elevation of privilege vulnerability in the Windows Logon installer which could allow an authenticated local attacker to overwrite files in privileged directories (CVE-2020-3427). The vulnerability was limited to the installer only, and did not affect the application once installed.

Version 4.1.1 - July 13, 2020

  • Updated installer to remove the password check that contributed to user lockouts in v4.1.0 when installed on Active Directory Domain Controllers. Customers with v4.1.0 installed should upgrade to v4.1.1 at the earliest opportunity.

Version 4.1.0 - April 29, 2020

There is a known issue with installation of Duo Authentication for Windows Logon and RDP version 4.1 on Active Directory domain controllers that may trigger user lockouts.
  • Introduces User Elevation, which adds the 2FA Duo prompt for credentialed User Account Control.
  • GPO template updated to include User Elevation configuration.
  • SHA-256 signed installer.
  • Additional bug fixes and security enhancements

Version 4.0.7 - October 2019

  • Fixes an issue related to multiple in-flight authentications.
  • Support for Windows Server 2008 R2 and Windows 7 ends in January 2020. Future releases may not function on unsupported operating systems.

Version 4.0.6 - September 2019

  • Added a support tool that sanitizes and packages config and log files into a zip file you can send to Duo Support when troubleshooting issues.
  • Added log file rotation.
  • Added additional UI installer options for HTTP proxy settings.
  • Updated GPO template to include log file rotation and Offline Authentication configuration.
  • Removed .NET dependency for the installer connectivity check.
  • Fixed a bug that would result in "Ordinal Not Found" being displayed in certain scenarios.
  • Fixed the flow of windows password changes that could cause re-enrollment in Offline Authentication.
  • Removed errant log message stating "Duo Auth Not Configured".
  • Response to CERT/CC Vulnerability Note VU#576688.
  • Security improvements for Offline Authentication.
  • Additional bug fixes and security enhancements.

Version 4.0.5 - April 2019

  • Correct issue enforcing secure failmode (FailOpen=0) when the Offline Access feature is disabled at the client system (OfflineAvailable=0). PSA-2019-001 (CVE-2019-11237)

Version 4.0.3 - February 2019

  • Corrected issue with installer not preserving configured options on upgrade.

Version 4.0.2 - February 2019

  • Corrected an issue with offline access de-provisioning registered users unexpectedly after a bypass login.
  • Installer dialog changes for integration and smart card options.
  • Command line installer now permits setting all configuration options.
  • Fixed issues with installer product codes that affected MSI in-place upgrades.

Version 4.0.1 - December 2018

  • UsernameFormatForService setting now respected when set via GPO.
  • Bug fixes.

Version 4.0.0 - November 2018

  • Introduces offline access with Duo MFA.
  • Adds support for Windows Server 2019. Deprecates support for Windows 8 and 2008.
  • Now includes the Windows hostname of the system where Duo is installed in the Duo authentication logs for both remote and local console logins.
  • Bug fixes

Version 3.1.2 - May 2018

  • Installer improvements, including a new API connectivity check

Version 3.1.1 - October 2017

  • Supports chaining Duo authentication with smart card logon
  • Configurable username format for Duo now supports userPrincipalName (UPN)
  • Bug fixes

Version 3.1.0 - July 2017

  • Support for wrapped credential providers
  • Permits an allow list of third-party credential providers
  • Configurable Duo username format sAMAccountName or NTLM name (msDS-PrincipalName)
  • Silent MSI command line upgrade

Version 3.0.0.85 - February 2017

Version 2.1.0 - September 2016

Version 2.0.0.71 - February 2016

Version 1.2.0.14 - August 2015

Version 1.1.8 - September 2014

Version 1.1.7 - April 2014

  • Ensured that the secondary login window always appears on Server 2012, Windows 8, and newer

Version 1.1.6 - April 2014

  • Fixed upgrades using .msi installers in headless mode

Version 1.1.5 - March 2014

  • Fixed log on to domain accounts on offline workstations
  • Fixed log on to domain accounts with usernames that match local accounts

Version 1.1.4 - Jan 2014

  • Bugfixes

Version 1.1.3 - Jan 2014

  • Fixed double-prompt for username/password when logging into Windows 7 / Server 2008 R2 (or newer) with an RDP client supporting Network-Level Authentication

Version 1.1.2 - Oct 2013

  • Used a more reliable mechanism to determine client IP addresses

Version 1.1.1 - Oct 2013

  • Fixed issues parsing usernames

Version 1.1.0 - Sept 2013

Version 1.0.7 - July 2013

Version 1.0.6 - November 2012

  • Released Windows Server 2003 version