It is hard to manage multiple users and systems, especially when there are not even hundreds, but thousands of them in a network. That’s why businesses and organizations love Microsoft Active Directory. It allows for storing and managing all the information on the organization’s systems, users, their credentials, sites and whatever else you might think of in a network, in one place. But you must agree that this much of fundamentally important information kept in one place makes Active Directory a tidbit for hackers. And simple password-username verification is far from sufficient to protect it all from attacks. This is why multifactor authentication is especially crucial for Active Directory security. Dynamic Strong Password Authentication (DSPA) solution from Protectimus has it well-covered for you and your users. Adding the second layer of security to all systems and services attached to Active Directory in one go has never been easier. In this article, we will describe in detail how our two-factor authentication solution for Active Directory works, why ours is the easiest approach to Active Directory MFA, which methods of MFA can be used with it and how to get it running. We will also provide answers to the most asked questions on our solution for the Active Directory multi-factor authentication. Download component for Active Directory 2FA How it works Protectimus Dynamic Strong Password Authentication (DSPA) operates via direct Active Directory integration and replaces static passwords with dynamic one-time passwords (OTP) generated using the TOTP algorithm. These passwords change automatically according to the policy configured by the administrator and are delivered to users through the Protectimus SMART authenticator app or Protectimus BOT in supported messengers. As a result of this integration, users authenticate using the current one-time password generated by Protectimus SMART or delivered through Protectimus BOT. Since access to the authenticator app or messenger is protected by a PIN code, password, or biometric verification, the authentication process combines possession of the user’s device with an additional authentication factor. The company’s Active Directory server administrator can set the time-step, in which the OTP is changed, to 30 seconds or more (for example, for 600 seconds). Besides, DSPA policies can be applied selectively to specific groups of users, allowing administrators to enforce OTP-based authentication only for selected accounts or services. | Read also: Two-factor authentication for Windows 7, 8, 10 Advantages of this approach to AD 2-factor authentication 1. Advanced Active Directory security Every regular 2-factor verification arrangement adds the second layer to the endpoints only. As a result, the hackers have a window to bypass 2FA and call the user directory up straightforward. Active Directory domain is easily called up through the Windows command prompt, so the hacker simply needs a user’s credentials (login and password) to act maliciously under their name and no Active Directory 2-factor authentication will be there to stop him. Protectimus DSPA enables complete directory-level protection and ensures that no one can access Active Directory without a valid dynamic one-time password obtained through Protectimus SMART or Protectimus BOT. 2. Ease of use and maintenance for AD administrators Another issue that our solution for Active Directory two-factor authentication easily fixes is the need for multiple 2FA solutions for various accounts, services, and platforms. Traditionally the administrators have to implement different MFA solutions for different services that are in use by their company, then install this additional software on every user’s device. Needless to say, all this software has to be maintained and regularly updated. Protectimus DSPA is a brilliant solution for this issue, integrating it with AD extends OTP-based authentication to every service and platform connected to Active Directory. | Read also: 2FA Security Flaws You Should Know...