#Duo app windows install#
#Duo app windows software#
#Duo app windows Offline#
#Duo app windows free#
#Duo app windows windows#

Of importance is the setting “ Bypass Duo authentication when offline (FailOpen)”. For local installations of the Duo agent, the following registry path is used to house the configured settings:įigure 5 shows some of the integration settings that can be applied. The integration options can be updated to change how Duo behaves on computers, such as allowing FailOpen (more on this later), automatically sending push notifications, or only protecting RDP logons (and not local logons). The API hostname, IKey, SKey and integration options are stored in the computer’s registry.

#Duo app windows install#

Figure 3: Install - API endpoint configuration Figure 4: Install - API key configuration

An outbound HTTP proxy can also be configured if a computer does not have direct outbound Internet access in an environment. Figure 3 and Figure 4 show how these values are configured during an interactive installation process. This allows the Duo application agent to communicate with the correct API hostname and apply the appropriate policies.

#Duo app windows windows#

When installing Duo Authentication on Windows computers, the API hostname, integration key (IKey) and secret key values (SKey) for a specified (unique) Duo instance and RDP application need to be configured. Figure 2: Duo authentication flow Looking Under the hood.

#Duo app windows software#

If the Duo software agent is not able to reach the cloud-based API, there are configuration settings which can be enforced that can either bypass MFA, or require that MFA must be required to authenticate.įigure 2 shows an authentication flow diagram explaining how Duo is integrated to the logon process.To perform this API request, the software agent on the Windows device requires that API keys are configured. For the computer to verify that the MFA requirements have been successfully met, the Duo software will perform API queries to a cloud-based API URL associated with a Duo tenant.HOTP (HMAC-Based One-Time Password) /TOTP (Time-based One-Time Password) from a security key.Entering a “Passcode” from the Duo app installed on a mobile device.Sending a “Passcode” via calling a phone number or sending an SMS message.Sending a “Push” notification to a mobile device with the Duo App.Depending on the device type selected there are various authentication methods that can be used to fulfill the MFA requirements.This prompt presents the user with a drop-down menu to select one of their Duo enrolled devices such as a phone, tablet, or security key device. If their credentials are determined to be valid, a Duo authentication prompt window appears while the computer remains locked. A user enters their credentials (local or domain account) to the computer via the local login prompt or via the RDP client.When a computer has Duo installed and configured to enforce MFA (either using a local Duo agent installation or deployment via GPO), the login flow for a user is as follows. Additionally, at the time of this writeup, Duo MFA integration when using Restricted Admin Mode RDP is not supported. Duo does not enforce MFA on endpoints for other services and logon methods such as when using PowerShell, scheduled tasks, SMB, WMI, PsExec, or WinRM. Duo can then enforce MFA when a user logs into Windows either locally or using the remote desktop protocol (RDP), or when a user account control (UAC) elevation is required. Duo Authentication in Windows and ADĭuo integrates with Microsoft Windows via a software agent (Duo Authentication for Windows Logon) that must be installed on endpoints. A background on how Duo authentication works on a Windows computer or in an AD environment will help understand the abuses and misconfigurations. Duo authentication policies allow for fine-grained control over MFA requirements and MFA flows. Duo client-side configurations, service settings, and agent deployments can be configured either manually on endpoints, or by using AD group policy objects (GPOs). Client-side configuration settings help support a wide range of use-cases and can be configured for offline access in the event of Internet or Duo API connectivity issues. This helps secure workstations against compromised credentials by requiring users to fulfil MFA requirements in order to logon to computers.

#Duo app windows free#

Create a Free Mandiant Advantage Accountĭuo Authentication integrates with Microsoft Windows and Active Directory (AD) to support multi-factor authentication (MFA) for both remote desktop and local logons.