Duo does not enforce MFA on endpoints for other services and logon methods such as when using PowerShell, scheduled tasks, SMB, WMI, PsExec, or WinRM. Duo can then enforce MFA when a user logs into Windows either locally or using the remote desktop protocol (RDP), or when a user account control (UAC) elevation is required. Duo Authentication in Windows and ADĭuo integrates with Microsoft Windows via a software agent (Duo Authentication for Windows Logon) that must be installed on endpoints. A background on how Duo authentication works on a Windows computer or in an AD environment will help understand the abuses and misconfigurations. Duo authentication policies allow for fine-grained control over MFA requirements and MFA flows. Duo client-side configurations, service settings, and agent deployments can be configured either manually on endpoints, or by using AD group policy objects (GPOs).
Client-side configuration settings help support a wide range of use-cases and can be configured for offline access in the event of Internet or Duo API connectivity issues. This helps secure workstations against compromised credentials by requiring users to fulfil MFA requirements in order to logon to computers. Create a Free Mandiant Advantage Accountĭuo Authentication integrates with Microsoft Windows and Active Directory (AD) to support multi-factor authentication (MFA) for both remote desktop and local logons.Noteholder and Preferred Shareholder Documents.
0 kommentar(er)
