Skip to main content

Authenticating to windows endpoints

How to authenticate into a Windows endpoint with AuthNull MFA?

Users sign in to a Windows endpoint with their own account, as they normally would at the logon screen or over RDP. AuthNull adds a second factor: a push to the user's phone, sent through your organisation's MFA provider.

note

Earlier versions of this page described checking an endpoint user out to a wallet and connecting through Connections → Connect Now. Both have been retired: AuthNull no longer delivers credentials to a wallet, and the Connections screen has been removed from the console.

Before you start​

  1. Choose an MFA provider - Under Settings → MFA Provider, select AuthNull Authenticator, Duo Security or Okta Verify.
  2. Enrol users' devices - With AuthNull Authenticator, open Users, choose Register device from the row's ⋯ menu, then Send by email or Show invite. With Duo or Okta, users approve in that provider's app.
  3. Protect the endpoint - Pick the option that matches the accounts you want to protect:
    • Local accounts, or local and domain accounts on one machine: install the AuthNull agent. In Switch product → PAM → Targets → Endpoints, click Add endpoint, choose Windows, and set Enforce MFA for to Local Users Only, LDAP/Active Directory Users Only, EntraID or BOTH ( Local + LDAP ). See Agent based MFA for Windows.
    • Domain accounts across the domain, with nothing installed on the endpoints: install the DC Sensor on your Domain Controllers and require MFA with a policy. See Agentless MFA for Windows.

Signing in​

  1. Sign in to the endpoint

    • At the Windows logon screen, or in your RDP client, enter the account's username and password.

  2. Approve the push

    • AuthNull sends an MFA push to your phone. Approve it to complete the logon. If the push is denied or expires, the logon is refused.

If you need a local account's password​

AuthNull no longer hands out local account passwords through a wallet. Where AuthNull stores an account's password, an administrator can reveal it with Reveal · break-glass on Targets → Endpoint Users, behind an MFA push to their own phone. See Passwords.