It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure each user account in AD for certificates. You don't have to modify IIS if you are planning on doing just Windows auth, but if you want mutual auth in IIS with client certificates then you'd have to set it up. If the app running in IIS doesn't support Windows Auth then the app needs to be modified to support multifactor auth. If you use a 3rd party solution then it all depends on how they implement it. The company I work for has a credential provider for Windows as well as an API for custom applications and an ISAPI module for IIS, etc. RSA's solution is similar, as are 99% of all other solutions.
Like I said, it depends on the technology you use, but basically it all boils down to: you have to modify all points of authentication where you require multifactor auth and if it can't support it, disable it.