{"id":2311,"date":"2021-07-30T23:30:46","date_gmt":"2021-07-30T23:30:46","guid":{"rendered":"https:\/\/dft.wiki\/?p=2311"},"modified":"2026-06-08T22:33:37","modified_gmt":"2026-06-09T02:33:37","slug":"configuring-mfa-for-windows-logon-and-rdp-with-duo-security","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2311","title":{"rendered":"Configuring MFA for Windows Logon and RDP with Duo Security"},"content":{"rendered":"

Windows Logon and RDP are easy to brute force because they do not offer built-in multi-factor authentication.<\/p>\n

To add MFA or 2FA to Windows, a third-party application is required to generate a One-Time Password (OTP) each time a user logs in.<\/p>\n

The OTP can be sent to a smartphone via Push Notification, SMS, or other methods.<\/p>\n

Cisco acquired Duo Security in 2018 but still offers a free plan called Duo Free [Link<\/a>] for up to 10 users.<\/p>\n

\n

Creating a Duo Security Account<\/strong><\/p>\n

Go to the Duo Security website [Link<\/a>] and create an account:<\/p>\n

\"\"<\/p>\n

Check your email and click the link to verify your account.<\/p>\n

A QR Code will be generated. Keep it on your screen for the next step.<\/p>\n

\n

Installing Duo Mobile<\/strong><\/p>\n

On your smartphone, install the Duo Mobile app from the Android [Link<\/a>] or iPhone [Link<\/a>] store:<\/p>\n

\"\" \"\"<\/p>\n

Use the app to scan the QR Code generated in the previous step.<\/p>\n

This will create your first token, which is tied to the management dashboard.<\/p>\n

\n

Protecting an Application (RDP)<\/strong><\/p>\n

Go to Application<\/strong> > Protect an Application<\/strong> > Search for Microsoft RDP<\/strong> > Protect<\/strong>.<\/p>\n

Click on RDP documentation.<\/strong> A new browser tab will open with the download link<\/strong> for the Windows application.<\/p>\n

\"\"<\/p>\n

Download page:<\/p>\n

\"\"<\/p>\n

During installation, you will be prompted to enter the API hostname<\/strong>:<\/p>\n

\"\"<\/p>\n

Then enter the Integration<\/strong> and Security<\/strong> Keys:<\/p>\n

\"\"<\/p>\n

Configure the remaining options as needed or leave them as default.<\/p>\n

Do not log out yet.<\/p>\n

\n

Adding Users<\/strong><\/p>\n

Go to Users<\/strong> > Add a User<\/strong>.<\/p>\n

The username must match the Windows account username exactly.<\/p>\n

Set the Status to Active<\/strong> and click Save Changes<\/strong>.<\/p>\n

Note: if you log out at this point, you will be locked out:<\/p>\n

\"\"<\/p>\n

To regain access, set the Status to Bypass<\/strong> and click Save Changes<\/strong>.<\/p>\n

Now add an Email<\/strong> address for the account, switch the Status back to Active<\/strong>, and click Save Changes.<\/strong><\/p>\n

Click Resend Enrollment Email<\/strong> at the top:<\/p>\n

\"\"<\/p>\n

A confirmation will appear:<\/p>\n

\"\"<\/p>\n

\n

Enrolling Users<\/strong><\/p>\n

Enrollment creates the token that grants access to the protected applications, in this case Windows Logon and RDP.<\/p>\n

Each user must also have Duo Mobile<\/strong> installed on their smartphone.<\/p>\n

Each user needs to open the enrollment email and click the link on their smartphone<\/strong>.<\/p>\n

\"\"<\/p>\n

Log out and try logging back in. The following window will appear:<\/p>\n

\"\"<\/p>\n

A push notification will be sent to your smartphone. Tap Approve<\/strong>.<\/p>\n

\n

Do not panic if you get locked out!<\/strong><\/p>\n

You can always allow a user, group, or the entire workgroup to bypass 2FA if needed.<\/p>\n

Make sure the username in Duo matches the Windows account username.<\/p>\n

Verify that the user has enrolled correctly and has their mobile token available.<\/p>\n","protected":false},"excerpt":{"rendered":"

Windows Logon and RDP are easy to brute force because they do not offer built-in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2311","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2311"}],"version-history":[{"count":9,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2311\/revisions"}],"predecessor-version":[{"id":5718,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2311\/revisions\/5718"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}