{"id":19509,"date":"2026-10-02T09:00:12","date_gmt":"2026-10-02T09:00:12","guid":{"rendered":"https:\/\/www.protectimus.com\/?page_id=19509"},"modified":"2026-10-09T13:29:42","modified_gmt":"2026-10-09T13:29:42","slug":"agentless-mfa-for-active-directory","status":"publish","type":"page","link":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/","title":{"rendered":"Agentless mfa for active directory: How DSPA Works"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"19509\" class=\"elementor elementor-19509\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-223acb9 padded e-flex e-con-boxed e-con e-parent\" data-id=\"223acb9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e4740cc elementor-widget elementor-widget-heading\" data-id=\"e4740cc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Agentless MFA for Active Directory: How DSPA Works<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-045bb52 e-con-full e-flex e-con e-child\" data-id=\"045bb52\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-b4a66c0 e-con-full e-flex e-con e-child\" data-id=\"b4a66c0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d41dfc9 elementor-widget elementor-widget-text-editor\" data-id=\"d41dfc9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Quick answer:<\/b> Agentless MFA for Active Directory means adding a second authentication factor at the directory level itself, rather than installing a client-side agent on every endpoint or configuring a separate integration for every AD-connected service. <a href=\"https:\/\/www.protectimus.com\/ru\/dspa\/\">Protectimus DSPA<\/a> (Dynamic Strong Password Authentication) implements this by replacing a user&#8217;s AD password with a rotating dynamic time-based one-time password. Because the change happens inside Active Directory, any service that authenticates directly against the AD password (Winlogon, RDP, LDAP-bound applications, command-line AD access) inherits the protection automatically. For setup instructions, see the <a href=\"https:\/\/www.protectimus.com\/ru\/guides\/dspa\/\">DSPA integration guide<\/a>. For help deciding whether an agentless or component-level approach fits your environment, see <a href=\"https:\/\/www.protectimus.com\/ru\/mfa-for-active-directory\/\">MFA for Active Directory: Complete Guide<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b35c05a elementor-widget elementor-widget-html\" data-id=\"b35c05a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">\r\n{\r\n  \"@context\": \"https:\/\/schema.org\",\r\n  \"@type\": \"BreadcrumbList\",\r\n  \"itemListElement\": [\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 1,\r\n      \"name\": \"Home\",\r\n      \"item\": \"https:\/\/www.protectimus.com\/\"\r\n    },\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 2,\r\n      \"name\": \"Solutions\",\r\n      \"item\": \"https:\/\/www.protectimus.com\/solutions\/\"\r\n    },\r\n    {\r\n      \"@type\": \"ListItem\",\r\n      \"position\": 3,\r\n      \"name\": \"MFA for Active Directory\",\r\n      \"item\": \"https:\/\/www.protectimus.com\/mfa-for-active-directory\/\"\r\n    }\r\n  ]\r\n}\r\n<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7332fbc e-con-full e-flex e-con e-child\" data-id=\"7332fbc\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4b0f868 elementor-widget elementor-widget-heading\" data-id=\"4b0f868\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Table of Contents\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b78b60 elementor-widget elementor-widget-text-editor\" data-id=\"4b78b60\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol>\n<li><a href=\"#what-agentless-means\">What &#171;Agentless&#187; Means for Active Directory MFA<\/a><\/li>\n<li><a href=\"#how-dspa-achieves-coverage\">How DSPA Achieves Directory-Level Coverage<\/a><\/li>\n<li><a href=\"#requirements\">Requirements &amp; Limitations<\/a><\/li>\n<li><a href=\"#services-protected\">What Services Get Protected Automatically<\/a><\/li>\n<li><a href=\"#closer-look\">Agentless vs. Component-Level: A Closer Look<\/a><\/li>\n<li><a href=\"#totp-fido2\">Where TOTP Fits Alongside FIDO2 and Passkeys<\/a><\/li>\n<li><a href=\"#security-implications\">Security Implications: MFA Bypass, Credential Theft, and Lateral Movement<\/a><\/li>\n<li><a href=\"#faq\">FAQ<\/a><\/li>\n<li><a href=\"#conclusion\">Conclusion<\/a><\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cdef92e padded e-flex e-con-boxed e-con e-parent\" data-id=\"cdef92e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-56c84d1 elementor-widget elementor-widget-heading\" data-id=\"56c84d1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Key facts\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bff780b elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"bff780b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d391a8f e-grid e-con-boxed e-con e-child\" data-id=\"d391a8f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-64a96a2 border-left e-flex e-con-boxed e-con e-child\" data-id=\"64a96a2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4dfef98 elementor-widget elementor-widget-heading\" data-id=\"4dfef98\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Credential replay has a shelf life<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0cc1bea elementor-widget elementor-widget-heading\" data-id=\"0cc1bea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">DSPA<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f5e29e2 elementor-widget elementor-widget-text-editor\" data-id=\"f5e29e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>By continuously rotating AD passwords, DSPA limits the window for reusing stolen passwords, potentially to just seconds, depending on when the credentials are captured and the rotation interval an administrator sets.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f5947b8 border-left e-flex e-con-boxed e-con e-child\" data-id=\"f5947b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fa74c1f elementor-hidden-desktop elementor-hidden-tablet elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"fa74c1f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-47e43b7 elementor-widget elementor-widget-heading\" data-id=\"47e43b7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">One integration, several entry points<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fb629a4 elementor-widget elementor-widget-heading\" data-id=\"fb629a4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Active Directory<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8085769 elementor-widget elementor-widget-text-editor\" data-id=\"8085769\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Winlogon, RDP, LDAP-bound applications, and command-line AD access all check the same Active Directory password. That&#8217;s exactly the layer DSPA operates on.<\/p><div id=\"gtx-trans\" style=\"position: absolute; left: -4px; top: -9.33333px;\"><div class=\"gtx-trans-icon\">\u00a0<\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c6c866e elementor-hidden-desktop elementor-hidden-tablet elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"c6c866e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5c0d1fa border-left e-flex e-con-boxed e-con e-child\" data-id=\"5c0d1fa\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d45db87 elementor-widget elementor-widget-heading\" data-id=\"d45db87\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Rotation in 30-second steps<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-344d455 elementor-widget elementor-widget-heading\" data-id=\"344d455\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">DSPA<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3a4d317 elementor-widget elementor-widget-text-editor\" data-id=\"3a4d317\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Administrators set the password rotation interval in multiples of 30 seconds, and the user&#8217;s authenticator app or chatbot generates codes on the same schedule.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0ae1e9a padded e-flex e-con-boxed e-con e-parent\" data-id=\"0ae1e9a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e899921 elementor-widget elementor-widget-heading\" data-id=\"e899921\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"what-agentless-means\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What \"Agentless\" Means for <br>Active Directory MFA<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-260a198 elementor-widget elementor-widget-spacer\" data-id=\"260a198\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f2e9500 elementor-widget elementor-widget-text-editor\" data-id=\"f2e9500\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>&#171;Agentless&#187; gets used loosely across the MFA industry, so it&#8217;s worth being precise about what it means specifically for Active Directory.<\/p>\n\n<p>Most MFA vendors install a small piece of software (an agent) on the machine or server where authentication happens: a Windows login screen, an RDP gateway, a VPN concentrator, a webmail login page. The agent sits in front of that login process, intercepts the attempt, and prompts for a second factor before letting the user through. This works well and is the more common model across the industry, but it means each protected entry point needs its own agent, its own configuration, and its own maintenance schedule.<\/p>\n\n<p>Agentless, directory-level MFA takes a different route. Instead of intercepting authentication at each individual endpoint, it changes what counts as a valid credential inside the directory itself. Protectimus DSPA does this by continuously updating users&#8217; passwords directly in Active Directory with dynamic time-based one-time passwords (TOTP). Passwords are automatically rotated at administrator-defined intervals, which must be multiples of 30 seconds.<\/p>\n\n<p>Nothing is installed on user workstations or on the servers running AD-connected applications. The directory enforces the check because the password itself is now time-limited: any system that was already built to validate a password against Active Directory continues doing exactly that, just against a password that no longer stays the same.<\/p>\n\n<p>This distinction matters for how you scope a rollout. Component-level MFA answers the question &#171;does this specific service require a second factor?&#187; one service at a time. Directory-level MFA answers a different question (&#171;what counts as a valid AD password?&#187;) once, at the source.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-30a9584 elementor-widget elementor-widget-spacer\" data-id=\"30a9584\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5b50e5c padded e-flex e-con-boxed e-con e-parent\" data-id=\"5b50e5c\" data-element_type=\"container\" data-e-type=\"container\" id=\"whyactive\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-28b1e56 e-con-full e-flex e-con e-child\" data-id=\"28b1e56\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a6f90e4 elementor-widget elementor-widget-heading\" data-id=\"a6f90e4\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"how-dspa-achieves-coverage\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How DSPA Achieves Directory-Level Coverage<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5f5336a elementor-widget elementor-widget-spacer\" data-id=\"5f5336a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d2498b elementor-widget elementor-widget-text-editor\" data-id=\"9d2498b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The mechanics of DSPA&#8217;s password rotation (how the OTP is generated, how the rotation interval is configured, how it connects to Active Directory via LDAP\/LDAPS) are covered in detail in the <a href=\"https:\/\/www.protectimus.com\/ru\/guides\/dspa\/\">DSPA integration guide<\/a>. This section focuses on a different question: why does this mechanism produce broad coverage without per-service configuration?<\/p><p>A conventional MFA agent has to be told, explicitly, which service it&#8217;s protecting. A Winlogon agent knows about Winlogon. An OWA plugin knows about OWA. Neither is aware the other exists, and neither one does anything for a service it wasn&#8217;t built to protect. Every new AD-connected application, in this model, means evaluating whether a matching integration exists, and building one if it doesn&#8217;t.<\/p><p>DSPA sidesteps this by operating one layer down, at the point where every one of those services already asks the same question: does this password match what&#8217;s stored in the directory? Once DSPA controls that answer, rotating the dynamic time-based one-time password on the administrator&#8217;s schedule, every service asking the question gets the updated answer automatically. Nothing about Winlogon, RDP, OWA, or an LDAP-bound application individually needs to change. They were already built to check the AD password; that&#8217;s precisely the mechanism DSPA modifies.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-14e8081 elementor-widget elementor-widget-html\" data-id=\"14e8081\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div style=\"max-width:640px;margin:30px auto;font-family:Arial,sans-serif;font-size:15px;line-height:1.5;color:#111111;\">\r\n\r\n  <div style=\"border:1px solid #111111;padding:16px 18px;text-align:center;background:linear-gradient(135deg,rgba(123,225,255,.45) 0%,rgba(123,225,255,.22) 45%,rgba(123,225,255,.05) 100%);\">\r\n    <strong>Protectimus On-Premise Platform + DSPA<\/strong><br>\r\n    Generates dynamic TOTP passwords and manages rotation\r\n  <\/div>\r\n\r\n  <div style=\"text-align:center;padding:10px 0;font-size:13px;color:#555555;\">\r\n    Updates user passwords via LDAP\/LDAPS<br><span style=\"font-size:18px;color:#111111;\">\u25bc<\/span>\r\n  <\/div>\r\n\r\n  <div style=\"border:1px solid #111111;padding:16px 18px;text-align:center;\">\r\n    <strong>Active Directory<\/strong><br>\r\n    User password = current dynamic OTP<br>\r\n    <span style=\"font-size:13px;color:#555555;\">Automatically updated at administrator-defined intervals<\/span>\r\n  <\/div>\r\n\r\n  <div style=\"text-align:center;padding:10px 0;font-size:13px;color:#555555;\">\r\n    Services validate the current AD password<br><span style=\"font-size:18px;color:#111111;\">\u25bc<\/span>\r\n  <\/div>\r\n\r\n  <div style=\"border:1px solid #111111;padding:16px 18px;text-align:center;\">\r\n    <strong>AD-Connected Services<\/strong><br>\r\n    Windows Logon \/ RDP<br>\r\n    OWA \/ ADFS<br>\r\n    LDAP Applications \/ Command-Line Access<br>\r\n    VPN \/ Wi-Fi (when authentication relies on AD)\r\n  <\/div>\r\n\r\n  <div style=\"text-align:center;padding:10px 0;\">\r\n    <span style=\"font-size:18px;\">\u25bc<\/span>\r\n  <\/div>\r\n\r\n  <div style=\"border:1px solid #111111;padding:16px 18px;text-align:center;background:linear-gradient(135deg,rgba(123,225,255,.45) 0%,rgba(123,225,255,.22) 45%,rgba(123,225,255,.05) 100%);\">\r\n    <strong>Directory-Level MFA Coverage<\/strong><br>\r\n    No separate MFA integration required for each service\r\n  <\/div>\r\n\r\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-59590f5 elementor-widget elementor-widget-text-editor\" data-id=\"59590f5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This is also why DSPA reaches entry points that per-service agents typically miss. Direct LDAP queries and Windows command-line AD access don&#8217;t go through a login screen an agent could intercept: there&#8217;s no UI to sit in front of. But they do check the same AD password DSPA controls, so the same rotation applies there without any additional configuration.<\/p>\n\n<p>The trade-off is that DSPA&#8217;s effect is broad by design. It isn&#8217;t possible to enable DSPA for one service and leave another one unaffected within the same directory scope: coverage follows the password, not the application. Administrators do have finer control through group-based policy: DSPA can be scoped to specific AD security groups, so it&#8217;s possible to roll it out to privileged accounts first, or to leave certain user groups on standard authentication during a transition period. What isn&#8217;t possible is applying it to one <em>service<\/em> while excluding another for users who are otherwise in scope.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d57877c padded e-flex e-con-boxed e-con e-parent\" data-id=\"d57877c\" data-element_type=\"container\" data-e-type=\"container\" id=\"howmfaactivedir\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-1698709 e-con-full e-flex e-con e-child\" data-id=\"1698709\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-88c2197 elementor-widget elementor-widget-heading\" data-id=\"88c2197\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"requirements\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Requirements &amp; Limitations<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cf95b82 elementor-widget elementor-widget-spacer\" data-id=\"cf95b82\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-83f93dd elementor-widget elementor-widget-text-editor\" data-id=\"83f93dd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3>Deployment Requirements<\/h3><p>Protectimus DSPA is deployed alongside the Protectimus On-Premise MFA Platform, either on your own servers or in a private cloud, and isn&#8217;t available through the Protectimus Cloud Service. Hardware and software requirements for both options are listed on the <a href=\"https:\/\/www.protectimus.com\/ru\/dspa\/\">Protectimus DSPA product page<\/a>.<\/p><p>\u00a0<\/p><h3>Coverage &amp; Limitations<\/h3><p>DSPA supports group-based policies, allowing administrators to enable password rotation for selected AD security groups. Protection applies to services that validate credentials against the current Active Directory password. VPNs and Wi-Fi may require additional configuration to connect their authentication to AD, often through RADIUS.<\/p><p>Because DSPA operates at the directory level, it cannot be enabled for one application while excluded from another for the same protected user.<\/p><p>\u00a0<\/p><h3>Service Accounts and Stored Credentials<\/h3><p>DSPA replaces static AD passwords with rotating OTPs. As a result, applications, services, scheduled tasks, or scripts that rely on stored static passwords will no longer be able to authenticate if their accounts are protected by DSPA. Administrators should review these dependencies before enabling password rotation and exclude accounts that must continue using static passwords from DSPA-enabled security groups.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-efc5953 padded e-flex e-con-boxed e-con e-parent\" data-id=\"efc5953\" data-element_type=\"container\" data-e-type=\"container\" id=\"componentvsdirectory\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-ee0fb21 e-con-full e-flex e-con e-child\" data-id=\"ee0fb21\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4907508 elementor-widget elementor-widget-heading\" data-id=\"4907508\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"services-protected\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Active Directory Services Can DSPA Protect<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3f1f175 elementor-widget elementor-widget-spacer\" data-id=\"3f1f175\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-65a3762 elementor-widget elementor-widget-text-editor\" data-id=\"65a3762\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Once DSPA is integrated with Active Directory, the rotating OTP requirement applies to every service that authenticates directly against the AD password, without a separate endpoint agent or per-service integration.<\/p><p><strong>Windows Authentication<\/strong><\/p><ul><li>Winlogon: domain-joined workstation login<\/li><li>RDP (Remote Desktop Protocol): remote access to Windows servers and workstations<\/li><li>Windows Server authentication: server-level access<\/li><\/ul><p>\u00a0<\/p><p><strong>Microsoft Email and Collaboration<\/strong><\/p><ul><li>OWA (Outlook Web Access): webmail access via Active Directory authentication<\/li><li>Exchange ActiveSync: mobile email synchronization<\/li><\/ul><p>\u00a0<\/p><p><strong>Directory Services<\/strong><\/p><ul><li>LDAP authentication: any application querying AD directly<\/li><li>Command-line AD access: programmatic access via Windows command line or scripts<\/li><\/ul><p>\u00a0<\/p><p><strong>Federation Services<\/strong><\/p><ul><li>ADFS 3.0 and 4.0: federated authentication inherits DSPA-protected credentials, since AD FS relies on Active Directory for the underlying password check<\/li><\/ul><p>\u00a0<\/p><p><strong>What about VPNs and RADIUS-based authentication?<\/strong><\/p><p>DSPA protection also extends to VPNs and other services that validate user passwords against Active Directory, including those connected through RADIUS. RADIUS is one of the ways to connect a VPN to Active Directory for user authentication. The <a href=\"https:\/\/www.protectimus.com\/radius\/\">Protectimus RADIUS component<\/a> provides an option for integrating VPNs and other RADIUS-compatible systems with Active Directory and Protectimus MFA.<\/p><p>\u00a0<\/p><h3>Comparison of coverage<\/h3><table><thead><tr><th>Service<\/th><th>Component-level MFA<\/th><th>Directory-level MFA (DSPA)<\/th><\/tr><\/thead><tbody><tr><td>Winlogon<\/td><td>Requires a dedicated agent<\/td><td>Covered automatically<\/td><\/tr><tr><td>RDP<\/td><td>Requires a dedicated agent<\/td><td>Covered automatically<\/td><\/tr><tr><td>OWA<\/td><td>Requires a dedicated plugin<\/td><td>Covered automatically<\/td><\/tr><tr><td>LDAP-bound applications<\/td><td>Not covered by endpoint agents<\/td><td>Covered automatically<\/td><\/tr><tr><td>Command-line AD access<\/td><td>Not covered by endpoint agents<\/td><td>Covered automatically<\/td><\/tr><tr><td>ADFS-federated apps<\/td><td>Requires a dedicated component<\/td><td>Inherits protection via AD FS<\/td><\/tr><tr><td>RADIUS-connected services (VPN, Wi-Fi)<\/td><td>Covered via the RADIUS component<\/td><td>Covered automatically when authentication relies on AD password validation<\/td><\/tr><\/tbody><\/table><p>\u00a0<\/p><p>The practical implication of the last row is worth emphasizing: while services like Windows Logon and OWA already rely on Active Directory for authentication, others, such as VPNs and Wi-Fi, may require additional configuration to connect to AD. RADIUS is one of the ways to establish this connection. Once these services authenticate directly against the AD password, they automatically benefit from DSPA protection, without requiring a separate MFA integration for each service.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b93ae31 padded e-flex e-con-boxed e-con e-parent\" data-id=\"b93ae31\" data-element_type=\"container\" data-e-type=\"container\" id=\"whichapproach\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-722b822 e-con-full e-flex e-con e-child\" data-id=\"722b822\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-10fb7be elementor-widget elementor-widget-heading\" data-id=\"10fb7be\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"closer-look\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Agentless vs. Component-Level MFA: What's the Difference<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-513a13a elementor-widget elementor-widget-spacer\" data-id=\"513a13a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-49e45ee elementor-widget elementor-widget-text-editor\" data-id=\"49e45ee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The practical difference between the two approaches shows up most clearly in three places: what happens when a new AD-connected service is added, what happens during an outage, and what an attacker sees when probing the environment.<\/p>\n\n<p><strong>Adding a new service.<\/strong> With component-level MFA, a new AD-connected application means evaluating whether a matching MFA integration exists, and building one if it doesn&#8217;t, which can leave a gap between when a service goes live and when it&#8217;s actually protected. With DSPA, a new service that authenticates against the AD password is covered the moment it&#8217;s connected to the directory, with no additional integration step required.<\/p>\n\n<p><strong>Failure behavior.<\/strong> A component-level agent that fails open, is misconfigured, or gets bypassed leaves exactly one service unprotected while the rest of the environment is unaffected: a contained failure. A DSPA outage, on the other hand, can affect authentication across multiple services that rely on DSPA-protected AD credentials. This is why DSPA deployments benefit from the same clustered, high-availability infrastructure as the rest of the Protectimus On-Premise Platform (recommended minimum is 3-node clustering with automatic failover) rather than running as a standalone service.<\/p>\n\n<p><strong>What an attacker sees.<\/strong> Component-level MFA protects the services it&#8217;s configured for and nothing else. An attacker who finds an AD-connected path without a matching agent (a direct LDAP query, a legacy application, a script using stored credentials) can often authenticate without hitting an MFA prompt at all, simply because no agent was watching that path. Because DSPA controls the password itself rather than a specific login screen, that kind of gap closes by default for services that rely on AD password authentication, rather than requiring each entry point to be identified and covered one integration at a time.<\/p>\n\n<p>None of this makes directory-level MFA categorically superior. Component-level MFA remains the better fit when the goal is to protect one or two specific entry points without changing authentication anywhere else, or when different systems have different rollout owners and timelines. The architectural differences above are what should inform that choice, not a general claim that one approach is &#171;more secure.&#187;<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-86abc7e padded e-flex e-con-boxed e-con e-parent\" data-id=\"86abc7e\" data-element_type=\"container\" data-e-type=\"container\" id=\"supportedintegrations\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-f0f2e30 e-con-full e-flex e-con e-child\" data-id=\"f0f2e30\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-684bcff elementor-widget elementor-widget-heading\" data-id=\"684bcff\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"totp-fido2\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where TOTP Fits Alongside FIDO2 and Passkeys<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac6abf7 elementor-widget elementor-widget-spacer\" data-id=\"ac6abf7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b52e3d elementor-widget elementor-widget-text-editor\" data-id=\"4b52e3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A reasonable question in 2026 is how TOTP-based MFA for Active Directory relates to newer phishing-resistant methods like FIDO2, WebAuthn, and passkeys.<\/p>\n\n<p>The practical answer: on-premise Active Directory environments, especially legacy services like Winlogon, RDP, LDAP, and command-line AD access, do not natively support FIDO2 across all entry points. TOTP-based MFA via DSPA closes those gaps today, working uniformly across every AD-authenticated service that checks the directory password directly, including legacy systems that lack native FIDO2 support.<\/p>\n\n<p>Organizations can deploy DSPA for broad AD coverage while using FIDO2 for high-value cloud applications accessed via ADFS or a cloud identity provider. The two approaches are complementary rather than competing: FIDO2 provides phishing-resistant authentication for the entry points that support it, while DSPA reduces phishing-related credential theft risks by replacing permanent AD passwords with rotating OTPs and extends protection to the on-premise entry points that lack native FIDO2 support.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-280411b padded e-flex e-con-boxed e-con e-parent\" data-id=\"280411b\" data-element_type=\"container\" data-e-type=\"container\" id=\"supportedmfa\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2bd5d59 e-con-full e-flex e-con e-child\" data-id=\"2bd5d59\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-347cae5 elementor-widget elementor-widget-heading\" data-id=\"347cae5\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"security-implications\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Security Implications: MFA Bypass, Credential Theft, and Lateral Movement<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2a817d1 elementor-widget elementor-widget-spacer\" data-id=\"2a817d1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3977085 elementor-widget elementor-widget-text-editor\" data-id=\"3977085\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Traditional client-based MFA protects specific authentication points, such as Windows Logon, RDP, or VPN access, but may leave alternative paths to Active Directory unprotected. An attacker with stolen credentials could bypass these MFA checks by authenticating through Windows command-line tools, LDAP-connected applications, or another service without its own MFA integration.<\/p><p>Credential theft through phishing, malware, or techniques such as DCSync creates opportunities for credential replay and password-based lateral movement. Because DSPA continuously rotates user passwords directly in Active Directory, stolen passwords have a much shorter window of usefulness. An attacker who captures a password one second into a 30-second rotation interval may have as little as 29 seconds to use it before the password changes.<\/p><p>Unlike endpoint-specific MFA, DSPA protects the AD password itself. Every service that validates credentials against the current AD password requires the current dynamic OTP, regardless of where the authentication request originates. This reduces opportunities to bypass MFA through alternative entry points and reuse stolen passwords across the infrastructure, without deploying a separate MFA component for each service.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a9cb282 padded e-flex e-con-boxed e-con e-parent\" data-id=\"a9cb282\" data-element_type=\"container\" data-e-type=\"container\" id=\"faq\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7659ffd elementor-widget elementor-widget-heading\" data-id=\"7659ffd\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"faq\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">FAQ<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dc81e4c e-con-full padded e-flex e-con e-child\" data-id=\"dc81e4c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-fb2596d e-con-full faq-container e-flex e-con e-child\" data-id=\"fb2596d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-412fa06 plus-right elementor-widget elementor-widget-n-accordion\" data-id=\"412fa06\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;all_collapsed&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6830\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6830\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Can MFA be applied to specific Active Directory groups rather than all users under DSPA? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6830\" class=\"elementor-element elementor-element-0787040 e-con-full e-flex e-con e-child\" data-id=\"0787040\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9eb7aff elementor-widget elementor-widget-text-editor\" data-id=\"9eb7aff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Yes. DSPA supports group-based MFA policy: administrators can apply directory-level password rotation only to specific AD security groups, which is useful for phased rollouts, starting with IT administrators and privileged accounts before extending coverage further. Users outside the protected group continue authenticating with their standard static password until they&#8217;re added to the group.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6831\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6831\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> What happens if a user loses access to their authenticator app under DSPA specifically? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6831\" class=\"elementor-element elementor-element-b3373c0 e-con-full e-flex e-con e-child\" data-id=\"b3373c0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6ef49d2 elementor-widget elementor-widget-text-editor\" data-id=\"6ef49d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Because the AD password itself depends on the current OTP, losing access to the authenticator blocks login until it&#8217;s resolved, not just to one application but to every AD-connected service at once. Protectimus SMART supports cloud backup, so users can restore their token to a new device without administrator intervention. For other cases, an administrator can temporarily exempt the affected user from DSPA rotation via the admin console while a new token is issued.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6832\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6832\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> How does DSPA compare to FIDO2 keys and passkeys for Active Directory? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6832\" class=\"elementor-element elementor-element-a41023b e-con-full e-flex e-con e-child\" data-id=\"a41023b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2a36881 elementor-widget elementor-widget-text-editor\" data-id=\"2a36881\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>FIDO2 and passkeys are phishing-resistant and work well for ADFS-federated applications and cloud scenarios, but they have limited native support across legacy on-premise AD entry points such as Winlogon, RDP, and LDAP. DSPA covers those entry points uniformly with TOTP-based rotation. The two approaches are commonly deployed together rather than treated as alternatives.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-6833\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-6833\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> Does DSPA cover VPN and Wi-Fi access? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"2\" viewBox=\"0 0 24 2\" fill=\"none\"><path d=\"M24 1L5.96046e-08 0.999999\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M12 0V24\" stroke=\"#111111\" stroke-width=\"2\"><\/path><path d=\"M24 12L5.96046e-08 12\" stroke=\"#111111\" stroke-width=\"2\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-6833\" class=\"elementor-element elementor-element-55c5ac8 e-con-full e-flex e-con e-child\" data-id=\"55c5ac8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2539954 elementor-widget elementor-widget-text-editor\" data-id=\"2539954\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Yes, provided their authentication relies on Active Directory password validation. VPN and Wi-Fi may require additional configuration to connect to AD, often through RADIUS. Once authentication relies on the AD password, these services automatically benefit from DSPA&#8217;s password rotation without requiring a separate MFA integration.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Can MFA be applied to specific Active Directory groups rather than all users under DSPA?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. DSPA supports group-based MFA policy: administrators can apply directory-level password rotation only to specific AD security groups, which is useful for phased rollouts, starting with IT administrators and privileged accounts before extending coverage further. Users outside the protected group continue authenticating with their standard static password until they&#8217;re added to the group.\"}},{\"@type\":\"Question\",\"name\":\"What happens if a user loses access to their authenticator app under DSPA specifically?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Because the AD password itself depends on the current OTP, losing access to the authenticator blocks login until it&#8217;s resolved, not just to one application but to every AD-connected service at once. Protectimus SMART supports cloud backup, so users can restore their token to a new device without administrator intervention. For other cases, an administrator can temporarily exempt the affected user from DSPA rotation via the admin console while a new token is issued.\"}},{\"@type\":\"Question\",\"name\":\"How does DSPA compare to FIDO2 keys and passkeys for Active Directory?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"FIDO2 and passkeys are phishing-resistant and work well for ADFS-federated applications and cloud scenarios, but they have limited native support across legacy on-premise AD entry points such as Winlogon, RDP, and LDAP. DSPA covers those entry points uniformly with TOTP-based rotation. The two approaches are commonly deployed together rather than treated as alternatives.\"}},{\"@type\":\"Question\",\"name\":\"Does DSPA cover VPN and Wi-Fi access?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, provided their authentication relies on Active Directory password validation. VPN and Wi-Fi may require additional configuration to connect to AD, often through RADIUS. Once authentication relies on the AD password, these services automatically benefit from DSPA&#8217;s password rotation without requiring a separate MFA integration.\"}}]}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7534fb4 elementor-widget elementor-widget-html\" data-id=\"7534fb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">\r\n{\r\n  \"@context\": \"https:\/\/schema.org\",\r\n  \"@type\": \"HowTo\",\r\n  \"name\": \"How to Set Up MFA for Active Directory with Protectimus\",\r\n  \"description\": \"Step-by-step setup of multi-factor authentication for Active Directory using Protectimus: registration, payment plan activation, resource creation, and user\/token assignment. Full end-to-end deployment typically takes 1\u20132 days.\",\r\n  \"totalTime\": \"PT2H\",\r\n  \"estimatedCost\": {\r\n    \"@type\": \"MonetaryAmount\",\r\n    \"currency\": \"USD\",\r\n    \"value\": \"0\"\r\n  },\r\n  \"supply\": [\r\n    {\r\n      \"@type\": \"HowToSupply\",\r\n      \"name\": \"Microsoft Active Directory or another LDAP-compatible directory\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToSupply\",\r\n      \"name\": \"Administrative access to the directory\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToSupply\",\r\n      \"name\": \"Server or private cloud meeting Protectimus On-Premise Platform requirements\"\r\n    }\r\n  ],\r\n  \"tool\": [\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"Protectimus On-Premise Platform\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"Protectimus DSPA component\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToTool\",\r\n      \"name\": \"Protectimus Smart OTP app or Protectimus Bot\"\r\n    }\r\n  ],\r\n  \"step\": [\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 1,\r\n      \"name\": \"Register with Protectimus\",\r\n      \"text\": \"Register with the Protectimus 2FA cloud service. Follow the registration link, fill out the registration form, and confirm your email address.\",\r\n      \"url\": \"https:\/\/www.protectimus.com\/mfa-for-active-directory\/#step-1\",\r\n      \"image\": \"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/07\/1.svg\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 2,\r\n      \"name\": \"Activate a payment plan\",\r\n      \"text\": \"To use the Protectimus SaaS platform and enable the API, activate a payment plan. Navigate to the Payment plans section of your account.\",\r\n      \"url\": \"https:\/\/www.protectimus.com\/mfa-for-active-directory\/#step-2\",\r\n      \"image\": \"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/07\/2.svg\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 3,\r\n      \"name\": \"Create a resource\",\r\n      \"text\": \"Resources are used to logically group users and OTP tokens. To create a resource, click Resources in your account menu on the left, then click Add resource at the top of the table.\",\r\n      \"url\": \"https:\/\/www.protectimus.com\/mfa-for-active-directory\/#step-3\",\r\n      \"image\": \"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/07\/3.svg\"\r\n    },\r\n    {\r\n      \"@type\": \"HowToStep\",\r\n      \"position\": 4,\r\n      \"name\": \"Add users and OTP tokens\",\r\n      \"text\": \"Create users and OTP tokens, and assign them to the resource you created earlier. Service users will need logins in the format login@domain.com.\",\r\n      \"url\": \"https:\/\/www.protectimus.com\/mfa-for-active-directory\/#step-4\",\r\n      \"image\": \"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/07\/4.svg\"\r\n    }\r\n  ]\r\n}\r\n<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fe2c5b0 padded e-flex e-con-boxed e-con e-parent\" data-id=\"fe2c5b0\" data-element_type=\"container\" data-e-type=\"container\" id=\"conclusion\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-e4ec716 e-con-full e-flex e-con e-child\" data-id=\"e4ec716\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-35746bf e-con-full e-flex e-con e-child\" data-id=\"35746bf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-489bd70 e-con-full e-flex e-con e-child\" data-id=\"489bd70\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-10cf0aa elementor-widget elementor-widget-heading\" data-id=\"10cf0aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Conclusion<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6c0eeb4 elementor-widget elementor-widget-text-editor\" data-id=\"6c0eeb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Agentless, directory-level MFA solves a specific problem: covering every service that authenticates against Active Directory without building and maintaining a separate integration for each one. Protectimus DSPA does this by rotating the AD password itself rather than intercepting logins at each endpoint, which is also why it reaches entry points, such as direct LDAP and command-line access, that endpoint-based MFA typically doesn&#8217;t.<\/p><p>It isn&#8217;t a universal replacement for component-level MFA. Organizations already relying on FIDO2 for cloud applications will likely keep doing so for those entry points. The value of the directory-level approach is concentrated where component-level MFA structurally struggles: broad, uniform coverage across everything that relies on AD password validation, including access paths such as LDAP authentication and command-line tools that don&#8217;t necessarily present a login screen for an agent to protect in the first place.<\/p><p>For setup instructions, see the <a href=\"https:\/\/www.protectimus.com\/ru\/guides\/dspa\/\">DSPA integration guide<\/a>. If you&#8217;re still deciding whether an agentless or component-level approach fits your environment, see <a href=\"https:\/\/www.protectimus.com\/ru\/mfa-for-active-directory\/\">MFA for Active Directory: Complete Guide<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a3f81ec e-con-full contact-us-bg e-flex e-con e-child\" data-id=\"a3f81ec\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fb3d121 elementor-widget elementor-widget-shortcode\" data-id=\"fb3d121\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\t\t<div data-elementor-type=\"container\" data-elementor-id=\"14847\" class=\"elementor elementor-14847 elementor-3585\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3a82e0d1 e-con-full e-flex e-con e-child\" data-id=\"3a82e0d1\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b4de036 elementor-widget elementor-widget-image\" data-id=\"b4de036\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"370\" height=\"370\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/05\/contact-seal.svg\" class=\"attachment-full size-full wp-image-12951\" alt=\"Send Us A Message icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1bc85d61 elementor-widget elementor-widget-heading\" data-id=\"1bc85d61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\u041e\u0442\u043f\u0440\u0430\u0432\u044c\u0442\u0435 \u043d\u0430\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cf09046 elementor-widget elementor-widget-shortcode\" data-id=\"cf09046\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n<div class=\"wpcf7 no-js\" id=\"wpcf7-f11990-o1\" lang=\"ru-RU\" dir=\"ltr\" data-wpcf7-id=\"11990\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/ru\/wp-json\/wp\/v2\/pages\/19509#wpcf7-f11990-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u043d\u0430\u044f \u0444\u043e\u0440\u043c\u0430\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"11990\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.2\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"ru_RU\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f11990-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<div class=\"protectimus-form\">\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"uname\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0418\u043c\u044f\" value=\"\" type=\"text\" name=\"uname\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Email\" value=\"\" type=\"email\" name=\"email\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"subject\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0422\u0435\u043c\u0430\" value=\"\" type=\"text\" name=\"subject\" \/><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col\">\n        <span class=\"wpcf7-form-control-wrap\" data-name=\"message\"><textarea cols=\"40\" rows=\"1\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"\u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\" name=\"message\"><\/textarea><\/span>\n    <\/div>\n<\/div>\n\n<div class=\"row\">\n    <div class=\"col mb-2\">\n        <input class=\"wpcf7-form-control wpcf7-submit has-spinner\" type=\"submit\" value=\"\u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c\" \/>\n    <\/div>\n<\/div>\n\n<\/div><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-584bd7e e-grid e-con-full equal-height equal-height-mob e-con e-child\" data-id=\"584bd7e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<a target=\"_blank\" target=\"_blank\" class=\"elementor-element elementor-element-3ef4592 e-con-full four-link e-flex e-con e-child\" data-id=\"3ef4592\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/service.protectimus.com\/en\/register\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2278d47 eq-height elementor-widget elementor-widget-heading\" data-id=\"2278d47\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Start free trial<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7af65ed elementor-widget elementor-widget-image\" data-id=\"7af65ed\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-11fd369 e-con-full four-link e-flex e-con e-child\" data-id=\"11fd369\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/www.protectimus.com\/ru\/contact-us\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-15127cf eq-height elementor-widget elementor-widget-heading\" data-id=\"15127cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Contact sales<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-29ad51c elementor-widget elementor-widget-image\" data-id=\"29ad51c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-67ce6f7 e-con-full four-link e-flex e-con e-child\" data-id=\"67ce6f7\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/www.protectimus.com\/ru\/pricing\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-39dc5c0 eq-height elementor-widget elementor-widget-heading\" data-id=\"39dc5c0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Pricing details<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b5c7dd4 elementor-widget elementor-widget-image\" data-id=\"b5c7dd4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-6c78411 e-con-full four-link e-flex e-con e-child\" data-id=\"6c78411\" data-element_type=\"container\" data-e-type=\"container\" href=\"https:\/\/www.protectimus.com\/ru\/guides\/saas-service\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6358276 eq-height elementor-widget elementor-widget-heading\" data-id=\"6358276\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-heading-title elementor-size-default\">Integration guides<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-23eb343 elementor-widget elementor-widget-image\" data-id=\"23eb343\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"28\" height=\"26\" src=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/icon-arrow-big.svg\" class=\"attachment-full size-full wp-image-14551\" alt=\"Arrow icon\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Agentless MFA for Active Directory: How DSPA Works Quick answer: Agentless MFA for Active Directory means adding a second authentication factor at the directory level itself, rather than installing a client-side agent on every endpoint or configuring a separate integration for every AD-connected service. Protectimus DSPA (Dynamic Strong Password Authentication) implements this by replacing a [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"class_list":["post-19509","page","type-page","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"google-site-verification\" content=\"6gzGBVioQ9rC9iYw9El7ERlDCLpc9c0ZqgJvbvqk0t4\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"ru_RU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"PROTECTIMUS\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Agentless MFA for Active Directory: How DSPA Works\" \/>\n\t\t<meta property=\"og:description\" content=\"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-02T09:00:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-09T13:29:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/protectimus\/\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@Protectimus\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Agentless MFA for Active Directory: How DSPA Works\" \/>\n\t\t<meta name=\"twitter:description\" content=\"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@Protectimus\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"\u0410\u0432\u0442\u043e\u0440\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"accounts@vipertop.com\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"14 \u043c\u0438\u043d\u0443\u0442\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#listItem\",\"name\":\"Agentless mfa for active directory: How DSPA Works\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#listItem\",\"position\":2,\"name\":\"Agentless mfa for active directory: How DSPA Works\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#organization\",\"name\":\"Protectimus Ltd\",\"description\":\"Protectimus Ltd is a multi-factor authentication provider offering cloud and on-premise MFA software, hardware OTP tokens, authenticator applications, and ready-to-use integrations for enterprise infrastructure.\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"email\":\"sales@protectimus.com\",\"telephone\":\"+17867966664\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/wp-content\\\/uploads\\\/2024\\\/02\\\/logo-icon.svg\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#organizationLogo\",\"width\":72,\"height\":51,\"caption\":\"Protectimus logo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/protectimus\\\/\",\"https:\\\/\\\/x.com\\\/Protectimus\",\"https:\\\/\\\/www.youtube.com\\\/@ProtectimusSolutions\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/protectimus-solution-ltd\\\/\",\"https:\\\/\\\/github.com\\\/protectimus\",\"https:\\\/\\\/www.g2.com\\\/products\\\/protectimus\\\/reviews\",\"https:\\\/\\\/www.capterra.com\\\/p\\\/182993\\\/Protectimus\\\/\",\"https:\\\/\\\/www.gartner.com\\\/reviews\\\/product\\\/protectimus\",\"https:\\\/\\\/sourceforge.net\\\/software\\\/product\\\/Protectimus\\\/\",\"https:\\\/\\\/www.getapp.com\\\/security-software\\\/a\\\/protectimus\\\/\",\"https:\\\/\\\/www.softwareadvice.com\\\/product\\\/462406-Protectimus\\\/\",\"https:\\\/\\\/www.trustradius.com\\\/products\\\/protectimus\\\/reviews\",\"https:\\\/\\\/www.trustpilot.com\\\/review\\\/protectimus.com\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#webpage\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/\",\"name\":\"Agentless MFA for Active Directory: How DSPA Works\",\"description\":\"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.\",\"inLanguage\":\"ru-RU\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/agentless-mfa-for-active-directory\\\/#breadcrumblist\"},\"datePublished\":\"2026-10-02T09:00:12+00:00\",\"dateModified\":\"2026-10-09T13:29:42+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#website\",\"url\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/\",\"name\":\"PROTECTIMUS\",\"inLanguage\":\"ru-RU\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.protectimus.com\\\/ru\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Agentless MFA for Active Directory: How DSPA Works<\/title>\n\n","aioseo_head_json":{"title":"Agentless MFA for Active Directory: How DSPA Works","description":"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.","canonical_url":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"6gzGBVioQ9rC9iYw9El7ERlDCLpc9c0ZqgJvbvqk0t4","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/#listItem","position":1,"name":"Home","item":"https:\/\/www.protectimus.com\/ru\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#listItem","name":"Agentless mfa for active directory: How DSPA Works"}},{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#listItem","position":2,"name":"Agentless mfa for active directory: How DSPA Works","previousItem":{"@type":"ListItem","@id":"https:\/\/www.protectimus.com\/ru\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/www.protectimus.com\/ru\/#organization","name":"Protectimus Ltd","description":"Protectimus Ltd is a multi-factor authentication provider offering cloud and on-premise MFA software, hardware OTP tokens, authenticator applications, and ready-to-use integrations for enterprise infrastructure.","url":"https:\/\/www.protectimus.com\/ru\/","email":"sales@protectimus.com","telephone":"+17867966664","logo":{"@type":"ImageObject","url":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/logo-icon.svg","@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#organizationLogo","width":72,"height":51,"caption":"Protectimus logo"},"image":{"@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/protectimus\/","https:\/\/x.com\/Protectimus","https:\/\/www.youtube.com\/@ProtectimusSolutions","https:\/\/www.linkedin.com\/company\/protectimus-solution-ltd\/","https:\/\/github.com\/protectimus","https:\/\/www.g2.com\/products\/protectimus\/reviews","https:\/\/www.capterra.com\/p\/182993\/Protectimus\/","https:\/\/www.gartner.com\/reviews\/product\/protectimus","https:\/\/sourceforge.net\/software\/product\/Protectimus\/","https:\/\/www.getapp.com\/security-software\/a\/protectimus\/","https:\/\/www.softwareadvice.com\/product\/462406-Protectimus\/","https:\/\/www.trustradius.com\/products\/protectimus\/reviews","https:\/\/www.trustpilot.com\/review\/protectimus.com"]},{"@type":"WebPage","@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#webpage","url":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/","name":"Agentless MFA for Active Directory: How DSPA Works","description":"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.","inLanguage":"ru-RU","isPartOf":{"@id":"https:\/\/www.protectimus.com\/ru\/#website"},"breadcrumb":{"@id":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/#breadcrumblist"},"datePublished":"2026-10-02T09:00:12+00:00","dateModified":"2026-10-09T13:29:42+00:00"},{"@type":"WebSite","@id":"https:\/\/www.protectimus.com\/ru\/#website","url":"https:\/\/www.protectimus.com\/ru\/","name":"PROTECTIMUS","inLanguage":"ru-RU","publisher":{"@id":"https:\/\/www.protectimus.com\/ru\/#organization"}}]},"og:locale":"ru_RU","og:site_name":"PROTECTIMUS","og:type":"article","og:title":"Agentless MFA for Active Directory: How DSPA Works","og:description":"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.","og:url":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/","og:image":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","og:image:secure_url":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","article:published_time":"2026-10-02T09:00:12+00:00","article:modified_time":"2026-10-09T13:29:42+00:00","article:publisher":"https:\/\/www.facebook.com\/protectimus\/","twitter:card":"summary_large_image","twitter:site":"@Protectimus","twitter:title":"Agentless MFA for Active Directory: How DSPA Works","twitter:description":"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.","twitter:creator":"@Protectimus","twitter:image":"https:\/\/www.protectimus.com\/wp-content\/uploads\/2024\/02\/protectimus-logo.png","twitter:label1":"\u0410\u0432\u0442\u043e\u0440","twitter:data1":"accounts@vipertop.com","twitter:label2":"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435","twitter:data2":"14 \u043c\u0438\u043d\u0443\u0442"},"aioseo_meta_data":{"post_id":"19509","title":"Agentless MFA for Active Directory: How DSPA Works","description":"How agentless, directory-level MFA secures Active Directory without endpoint agents: DSPA mechanics, service coverage, and security implications.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-10-19 10:03:12","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"open_ai":null,"ai":null,"created":"2026-10-02 08:44:25","updated":"2026-10-19 10:07:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.protectimus.com\/ru\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tAgentless mfa for active directory: How DSPA Works\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.protectimus.com\/ru\/"},{"label":"Agentless mfa for active directory: How DSPA Works","link":"https:\/\/www.protectimus.com\/ru\/agentless-mfa-for-active-directory\/"}],"_links":{"self":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/19509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/comments?post=19509"}],"version-history":[{"count":14,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/19509\/revisions"}],"predecessor-version":[{"id":19953,"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/pages\/19509\/revisions\/19953"}],"wp:attachment":[{"href":"https:\/\/www.protectimus.com\/ru\/wp-json\/wp\/v2\/media?parent=19509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}