With the pace of password-based security breaches, simply using usernames and passwords to secure a Windows login is no longer an option. That’s why it has become necessary to add an additional layer of two-factor authentication security to filter out unauthorized users.
miniOrange's Windows Two-Factor Authentication solution for windows logon prevents these sorts of Password-Based breaches and adds an additional layer of security to your Microsoft Windows account login. As the Windows 2FA / MFA feature is enabled, users have to authenticate themselves in two successive stages to access their Windows machines. The first level of authentication happens using their usual Windows credentials. For the second level of authentication, admins can choose from the wide range of 15+ 2FA authentication methods that miniOrange offers.
miniOrange integrates with Microsoft Windows client and server operating systems to add two-factor authentication to Remote Desktop (RDP) and local Windows Login. Windows 2FA solution is also responsible for your User Management with a Microsoft Active Directory or an LDAP directory. With this 2FA / MFA solution, users will get easy access to the endpoints they need to access by increasing identity assurance and reducing the risk and exposure. You can also enable offline access accordingly for secure authentication. Along with Windows MFA, miniOrange's advanced MFA solution organizations are able to get secure access to all work applications, for all their users, from anywhere, with any device they choose.
miniOrange 2FA Credential Provider for Windows Logon and Remote Desktop (RDP) access supports following Two-Factor Authentication (2FA/MFA) Methods:-
miniOrange Push Notification
OTP Over SMS
SMS with Link
OTP Over Email
Email with Link
OTP Over Call
Yubikey Hardware Token
Display Hardware Token
System Requirements for miniOrange Two-Factor Authentication (2FA / MFA) Credential Provider
miniOrange Credential Provider for Windows Logon and RDP Access supports both client and server operating systems.
Supported Microsoft Windows Client versions:
Windows 7 SP1
Supported Windows Server versions (GUI and core installs):
Windows Server 2008 R2 SP1
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows Server 2019
Windows Server 2022
Get Free Installation Help - Book a Slot
miniOrange offers free help through a consultation call with our System Engineers to Install or Setup Two-Factor Authentication (2FA) for Windows Logon and RDP solution in your environment with 30 days trial.
For this, you need to just send us an email at email@example.com to book a slot and we'll help you setting it up in no time.
Disable the methods you don’t want your users to configure or use for MFA
3. Setup miniOrange Two-Factor Authentication (2FA/MFA) Credential Provider for Windows Logon
Open miniOrange 2FA Configuration in Start Menu
Make sure "miniOrange service" status is running and in the "Credential Provider/GINA status" section the "Registered" and "Enabled" are "Yes". If any of these are not as intended, see this FAQ to fix it
3a : Integrate the module to miniOrange account.
Click on Plugin Selection, Double Click on miniOrangeunder plugin Name.
A 2FA Configuration form will open up
If you’re using Onpremise IDP application, please replace the IDP Server URL with base URL of your Onpremise IDP application and make sure that URL is accessible from this machine. You can also use the IP of the server where the IDP application is hosted.
To fill in these details, login to your miniOrange admin account on Cloud orOnpremise.
Click on the Settings cog on top right and select Product Settings
Copy the Customer Key and API key
Now, Go to Apps and copy the name of the Windows application created in step 2.
Paste all these details in the form and click on Save. Leave the checkboxes as it is. More about them later.
3b. Test MFA
Please make sure that at this point the user with same username as windows exists in miniOrange and has 2FA set up. For instructions on setting up 2FA from Self Service Console, see this link.
Click on Test MFA button.
Enter your machine username which is also present in miniOrange and click on Test MFA.
You will be prompted to select one of the 2FA methods you’ve configured. Select one method and click on Next
If asked for OTP, enter OTP and click on Login.
If asked for approval through Push notification, Accept the Push notification on your phone
After Successful Validation, you’ll see a Test Successful message
3c. Configure Domain
Skip this step if you’re not configuring this on a domain joined machine
In Plugin Selection tab, Double click on Domain User Login
Replace the domain name with your AD domain used before the username.
To check your domain name, you can also use the command: SET USERDOMAIN
Click on Save.
4. Use miniOrange MFA during login
You should see the miniOrange login page after locking the computer or signing Enter your username and password.
Note: The logo and Message on login page can be customized from the General tab in miniOrange configuration
If you’re using RDP, make an RDP connection using username and password
You’ll see the 2FA prompt. Proceed with selecting a 2FA option and validating it.
miniOrange Credential Provider for Remote Desktop (RDP) and Windows Logon
The user initiates the login to Windows or Remote Desktop Service either through a Remote Desktop Client or via the RD Web login page from his browser, after which the RADIUS request is sent from the miniOrange RD Web component installed on the target machine to the miniOrange RADIUS server, which authenticates the user via Local AD, and after successful authentication, Two-factor authentication (2FA) of the user is invoked. After the user validates himself, he is granted access to the Remote Desktop Service (RDP).
A user can try to connect to RDS (Remote Desktop Protocol (RDP)) via 2 ways :
RDC - Remote Desktop Client: If the RemoteApp is launched through a Remote Desktop client application, the users validate their 2-factor authentication while they enter the Username and Password to get access to the resources. (as this method doesn't support access-challenge response, only out of band authentication methods are supported).
RD Web Access - RD login page via browser: If the desktop or RemoteApp is launched through a RD Web Login page, the initial user authentication is done from the machine's AD, after which miniOrange challenges the user for 2-factor authentication via a RADIUS challenge request. After the users correctly authenticate themselves, they get connected to their resources.
Two-Factor Authentication (2FA/MFA) for RDS via RD Web
How it works
In this case, the user goes to RD Web login page from his browser to connect to the Remote Desktop Service. He enters his Username and Password, and on submission, the RADIUS request from RD Web component installed on target machine is sent to the miniOrange RADIUS server which authenticates the user via local AD in the target machine.
Once authenticated, it sends a RADIUS challenge to RD Web, and the RD Web shows OTP screen on browser now. Once the user enters the One Time Passcode, the miniorange IdP verifies it and grants/denies access to the RDS.
With this, after the user is connected to the Remote Desktop Service, the user can also gain access to published remote app icons on his browser screen, since the session has already been created for the user. Know more about Remote Desktop (RD) Web MFA