Two-factor authentication for Windows asks for a second factor after the Windows password, usually a one-time password (OTP) from a hardware token, an authenticator app, SMS, email, or a messenger chatbot. Third-party solutions add this step to the Windows sign-in screen through a component installed on the computer and can cover local accounts, domain accounts, and RDP sessions.
On most Windows workstations and servers, the password is still the only thing between the desktop and anyone who has obtained it, whether through a phishing page or a password reused on another site. Two-factor authentication closes that gap with a second check at sign-in. This article explains how 2FA works on Windows, how to enable it, and answers the questions administrators ask most often. If you are choosing a solution for your organization, see 2FA for Windows login from Protectimus.
How Does 2FA Work on Windows?
Two-factor authentication for Windows login is rather simple. The process consists of two successive levels of login, just as the name suggests. First, the user has to sign in with their common Windows credentials (their regular username and password).
On the second level, the user has to enter a one-time password (OTP). This password is valid only for 30-60 seconds and can be delivered or generated via a number of different ways, the user can choose which way they prefer. It can be a chat-bot message, 2FA app, email, SMS or one of our hardware security tokens.
Two-factor authentication for Windows ensures there’s minimum to none risk for the Windows user account to be breached if the user’s regular password is compromised. In this unfortunate case, the criminals will have to get access to the user’s email, phone or hardware token, which is much harder to accomplish. And at the same time, if the phone or OTP token is compromised, the attacker still has to guess the password.
Besides, each one-time password generated by your two-factor authentication token can be used only once and is time sensitive. This means that the generated code will simply expire and won’t be usable within 30-60 seconds. Which makes it almost impossible to intercept and have the code used for unauthorized access to the protected Windows account.
| Read also: 10 Windows Computer Safety Tips
How to Enable 2FA on Windows
It is very easy and fast to set up Protectimus dual factor authentication Windows solution and have your Windows 8, 8.1, 10 or 11 thoroughly protected from unauthorized access, the whole process usually takes less than 15 minutes.
This Windows two-factor authentication software is designed both for individual and business users. So it’s very easy to set it up. The set up can be done by any user themselves without involving an admin with special skills.
1. Create account in Protectimus Service
Fill out the registration form and create your Protectimus 2FA service account.
2. Activate a Service Plan
Choose a service plan and make sure to activate it, even if it’s a Free service plan. The API won’t function unless a service plan is activated. It can be deactivated at any time.
3. Create a Resource
To group and easily manage the users and tokens we use Resources. So the first step to actually start using Protectimus MFA for your Windows is to create a Resource, which is done by clicking one single button and giving a name to the Resource you created.
4. Enable Automatic Registration of Users and Tokens
Once a Resource is created, switch on automatic registration of Users and Tokens.
When the automatic registration of Users and Tokens is enabled, your users will enroll their tokens themselves during their first login to the Windows account after you install the Protectimus Winlogon solution on their computers.
Click on the name of your Resource.
Go to the Winlogon tab.
Activate:
- Access for unregistered users;
- User auto-registration;
- Token auto-registration;
- And choose the type of tokens your users can enroll (Protectimus Mail, Protectimus SMS, or Protectimus SMART OTP).
Note that you can also add Users and Tokens manually.
Read how to add Users manually here. The user login you create in Protectimus must be the same as your Windows username. Before creating a user, make sure that your Windows username contains only Latin characters, numbers and the following symbols: _-@∽!#%+.$. Spaces and any other symbols are not allowed.
If you want to add Tokens manually, read the instructions here.
Don’t forget to assign Tokens to specific Users and assign Tokens with Users to the Resource.
5. Download and install Protectimus Winlogon
Finally, you need to download and install Protectimus Winlogon, run the installer and test the MFA. Follow the guide to set up two-factor authentication for Windows logon closely: it covers the installer options, the 2FA policy, RDP access, and offline login.
All of the steps described above took more time to write down than actually following them does.
| Read also: The Pros and Cons of Different Two-Factor Authentication Types and Methods and MFA for RDP: Stop Unauthorized Remote Desktop Access Cold
Frequently Asked Questions
Does Windows have built-in 2FA?
Windows includes Windows Hello, which signs users in with a PIN, fingerprint, or face recognition tied to the device. Windows Hello for Business, used in organizations, counts as two-factor because it combines the device itself with a PIN or biometric. What Windows does not offer out of the box is a one-time password prompt at sign-in, so OTP-based 2FA with a hardware token or an authenticator app requires a third-party solution.
How much does it cost?
Protectimus has a free plan for up to 10 users. Paid plans depend on the number of users and on whether you use the cloud service or the On-Premise Platform; current plans are listed on the pricing page.
Can I use this solution for Microsoft RDP?
Yes. Protectimus Winlogon protects both local sign-in and Remote Desktop (RDP) sessions, including connections to terminal servers running Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025. RDP protection is switched on with a separate setting during configuration.
What versions of Windows OS are supported?
Windows 8, 8.1, 10, and 11, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
What authentication methods are available?
2FA applications, hardware OTP tokens, chat-bots in messaging apps, Email and SMS authentication.
To check which accounts, Windows versions, and token types are covered, see the Protectimus solution for Windows login.
Read more:
- Duo Security vs Protectimus
- Hardware Tokens for Azure MFA
- Office 365 MFA Hardware Token
- Keycloak Multi-Factor Authentication With Hardware Tokens
- Top 7 Tips How to Protect Yourself from Phishing Scams
- Man In The Middle Attack Prevention And Detection
- Social Engineering: What It Is and Why It Works
Please, let us know if you have any questions in comments or via email support@protectimus.com.
Subscribe To Our Newsletter
Join our mailing list to receive the latest news and updates from our team.
Subscribe To Our Newsletter
Join our mailing list to receive the latest news and updates from Protectimus blog.
You have successfully subscribed!