An organization has all the regular controls you can think of for network and systems protection from the 10 security domains. External login access to the organization's services is protected with 2 factor authentication. As an improvement on security posture, it is suggested that 2 factor authentication could be enabled on all user workstations. Given the fact that security controls ranging from physical security to logging access are well implemented, what are the pros and cons of implementing 2 factor authentication on all workstations of the organization?

1 Answer 1


Pros: You could gain security by having that the physical access card, that is used to open doors in organization, must be placed on a Reading pad or inserted in a smart card reader, and kept there to keep the computer logged in. As soon as the card is removed, computer is forcefully logged out. (shutdown /l /f /t 0)

I would advise against locking the computers instead of logging out them, both for security, but also so shared computers do not get "locked up" by careless users. Better to log the computer out, if the user want to continue working, he has to save his work prior to removing the card.

If this card is used to access basically all doors in the organization, even for the exit direction, even toilets and lets say vending Machines, coffe Machines, copy machine, printer, etc

then it will become a habit of the workers to actually Always bring the card with them when going anywhere.

This means that you dont need to logout the session after inactivity.

This means you can actually use it with a one-factor login (only card) instead to make the login extremely convient for the user. To protect against lost cards, you could have that the card needs to be presented and a PIN code needs to be entered, at the front door or lobby area, to enable the card for 12 hours.

Thus on the beginning on work day, the user has to use card+PIN to activate the card. After this, the card will work for 12 hours, in all doors and on all computers where the user is allowed to be.

Cons:The cost. It can be prohibilively expensive to buy RFID readers for computer login, or replace all RFID cards with combo Chip+RFID cards and then invest in Smart card readers.

  • If I have to close all of my applications and log out of my computer every time I get coffee or go pee, I will never get any meaningful amount of work done.
    – jjanes
    Dec 2, 2014 at 18:39
  • You dont need to log out, as soon as you remove card, computer is logged out. This with "locked computers" are not a good solution for a shared computer workplace, for example in my school, pupils very often forgot to log out on shared computers, so every computer required a admin password to use at all. Much worser solution than if you just need to save your work Before going for coffe or a pee. Locking to "1 computer per user account" did not help, so the final solution was to put a restriction in GPO that "Lock computer" was disabled. Dec 2, 2014 at 20:46
  • A better solution can be to invest in a roaming session solution, where your Active session are saved into a profile when you logout your computer, so next time you login to ANY computer, your session is restored, and you dont need to save your work and Close down Everything. But cheapest is to grow a habit in users to actually save Before going for coffee or peeing. Dec 2, 2014 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .