Skip to main content

Configure Agentless MFA for Windows

Agentless MFA protects domain logons to Windows machines without installing anything on the machines themselves. A single AuthNull DC Sensor on each Domain Controller intercepts Kerberos, NTLM and LDAP authentication and asks AuthNull whether to allow it, block it or require MFA. When MFA is required, AuthNull sends a push to the user's phone through your organisation's MFA provider.

note

Older versions of this page described installing agentless-install.ps1, which copied SubAuth.dll into System32 and added an Authd registry key. That installer has been retired. Use the DC Sensor described below instead.

Prerequisites​

  • Domain-joined machines - Agentless MFA covers domain accounts that authenticate against your Domain Controllers. To add MFA for local Windows accounts, use Agent based MFA for Windows.
  • Administrator access to each Domain Controller - The installer runs in an elevated PowerShell session on the DC.
  • A maintenance window - The installer registers an LSA security package, and NTLM enforcement does not take effect until the DC is rebooted.
  • An MFA provider - Choose one under Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify.

Step 1: Connect Active Directory​

Open Switch product → Active Directory, select Identity Provider in the sidebar, then Add Identity Provider → Active Directory. Fill in the Connect Active Directory step. See Connect Active Directory for the fields.

Step 2: Install the DC Sensor​

The wizard moves on to Install DC Sensor.

  1. Click Download sensor.yml and Download install.ps1, and copy both files into the same folder on the Domain Controller.

  2. Open PowerShell as Administrator, cd into that folder and run:

    .\install.ps1

  3. Confirm the service is running before you click Done:

    Get-Service AuthnullDCSensor

Full details, including verification and rollout notes, are in Install DC Sensor.

Step 3: Enrol users for push MFA​

Users approve MFA on their phone. If your MFA provider is AuthNull Authenticator, enrol each user's device: in Users, open the row's ⋯ menu and choose Register device, then either Send by email or Show invite for the user to scan. With Duo Security or Okta Verify, users approve in that provider's app instead.

Step 4: Require MFA with a policy​

MFA is switched on by policy, not per machine. In Policies, create a policy for the users, groups or OUs to protect and set its action to MFA Required. See AD Policies.

Step 5: Verify​

Sign in to a domain-joined Windows machine as a user covered by the policy. The user receives an MFA push on their phone; the logon completes once they approve it. The attempt appears under Logs.

Next Steps​