I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication.
Possible things that might have to be modified:
Active Directory / Domain Controllers
The application itself (IIS, Apache + the web site)
The server or workstation's Credential Provider (the new GINA)
It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure each user account in AD for certificates. You don't have to modify IIS if you are planning on doing just Windows auth, but if you want mutual auth in IIS with client certificates then you'd have to set it up. If the app running in IIS doesn't support Windows Auth then the app needs to be modified to support multifactor auth. If you use a 3rd party solution then it all depends on how they implement it. The company I work for has a credential provider for Windows as well as an API for custom applications and an ISAPI module for IIS, etc. RSA's solution is similar, as are 99% of all other solutions.
Like I said, it depends on the technology you use, but basically it all boils down to: you have to modify all points of authentication where you require multifactor auth and if it can't support it, disable it.
I recommend you consider using the MS Radius plugin to add two-factor auth to your applications. You need to either configure your apps to talk radius or put something in front of them that can handle radius auth, such as Forefront or an SSL-VPN. They will talk radius to NPS which will enforce conditions such as group membership. If all is ok, NPS will then proxy the credentials to the two-factor authentication server. See https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-nps for a brief overview.
The benefits: one location to disable users (AD), users login with username and OTP, so no using their password outside the LAN, you're using a strong standard in radius and can add numerous other systems and swap them out without trouble.
The GINA is another thing all together. You can look at something like pgina that supports radius, but there are problems. I think that's why a lot of companies are going with remote desktop solutions instead.
