1

My customer is a defense sub-contractor and has a requirement to implement multi factor authentication for just about everything short of going to the bathroom. It is possible to implement this within Windows server/AD without some sort of 3rd party system? Yes I googled it, and I see a lot of 3rd party companies offering solutions but if there is a way to do that without spending the extra money, that would be great. FWIW, it is a pretty small company with only about 20 employees and 10-15 PCs. Thanks for any suggestions.

8 Spice ups
2

USG MFA definitions are described by NIST’s AALs (authenticator assurance levels).

Microsoft describes how to do that with their technologies here :

f262e3b4-fe63-4ff3-9c48-61aa315f6d13-Screenshot_2023-03-09_174818.png

Depending on your requirements, your configuration will vary. Short answer is yes, Windows can do MFA with various technologies, such as:

  • Smart cards (Most of US Gov is doing this already) - this uses Windows AD Certificate Services and physical cards/readers
  • Windows Hello (uses TPM chips or other hardware)
  • Microsoft Authenticator (for Windows Server running in Azure)
  • and others

So as always: “What are you trying to accomplish, specifically?”

1 Spice up
3

Are they using O365?

1 Spice up
4

Thank you I will read that. And yes they are using O365. As far as what they are trying to accomplish, they need to be able to pass the NIST requirements.

5

We implemented AuthLite ( https://www.authlite.com/ ) for domain admin accounts. Pricing is reasonable and I was able to get it implemented quickly.

1 Spice up
6

Is this doable with on-premises AD? Everything I am reading mentions Azure AD and at this point they aren’t really using that.

7

MFA & Access Management for Active Directory (on-premise) users can be achieved easily with UserLock.

You can set granular and customized MFA on Windows logins, RDP & RD Gateway, IIS and VPN connections. It also will protect these on-premise accounts with MFA & Single Sign-on as they access Cloud applications - such as 0365.

  • Secure all employee access, whether privileged, remote or cloud
  • Streamline session management
  • Review accurate logon logoff forensics
  • Manage working hours
  • Stop security breaches
  • Meet compliance & insurance requirements, like: HIPAA, PCI DSS, ISO 27001, NIST 800-53.

Full details on MFA here: Multi-Factor Authentication for Active Directory

Short video: https://www.youtube.com/watch?v=jDu0LQl_du8&t=91s

Free trial download: Protect Active Directory Identities with 2FA and SSO | UserLock