1

My organisation is hoping to implement MFA for Windows. Our end users are generally not permitted to have their cellphones on them which means that many of these MFA apps cannot be used.

We've tried DUO but their windows integration has either fail closed or fail open when offline, failopen means that MFA is essentially useless since one factor is removed when disconnected from the internet.

I'd appreciate any thoughts.

Improve this question
  • 1
    This is likely to be closed as opinion based as it stands - there isn't a specific question. Asking whether anyone knows of a specific system to do this would be a product recommendation, so also off topic. Using hardware tokens with either TOTP or HOTP values shouldn't require internet access to use though. – Matthew Oct 23 '17 at 15:48
  • 1
    Why do you need MFA for local login? Is there a specific regulatory standard you are meeting? There may be something else that you can use as a second “factor” like MAC address authentication on the switch. – myron-semack Oct 24 '17 at 10:38
  • Smart cards have been a standard for a while. Windows laptops have had fingerprint scanners built-in. What exactly are you asking? – schroeder♦ Oct 24 '17 at 10:51
1

Sounds like you are asking for a 2FA solution for Windows login that supports offline authentication. You need a solution that keeps a copy of the authentication secret locally. Most of the modern 2FA providers like Duo are cloud based and do not support this.

You also need one that supports hardware tokens. Many do but you will have to pay for the tokens.

I believe RSA SecureID can do what you need. It is far more expensive than Duo however. https://www.rsa.com/en-us/products/rsa-securid-suite

Also look at Authlite. They use a hardware token but I am not sure if their method works offline: https://www.authlite.com/

Improve this answer
0

Check the Symantec Validation and ID Protection solution: https://www.symantec.com/products/validation-id-protection

Their datasheet suggests that they have hardware tokens (so you dont have to use Mobile phones) and has support for Windows 7.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.