Duo Time out and machine freezing

[ApetersBessemer]

We have a few users complaining after having Duo installed that if Duo times after after a minute and then the PC goes back to sleep it is then frozen. They can not hit dismiss or Crtl/Alt/Del\

The steps we used to repoduce this are:

• Lock your machine
• Put in credentials and leave your PC and DUO request alone
• About 1 minute after you screen goes to sleep, press a button on you keyboard
• The DUO prompt will be there and you can’t click on anything until something in Windows/DUO times out.

Anyone else see this?

[Paul Feather]

Yes, we have the same issue. We have told our users they must be attentive and immediately MFA or wait about 7 minutes until it times out and you can ctrl+alt+del again. I have yet to find a way of preventing it.

[ApetersBessemer]

Thank you for your feedback. Duo provided no useful information to me either.

[RobertRust]

I’ve run into this as well though primarily on RDP sessions. If there’s a network interruption, the RDP client may re-connect and trigger an MFA request. If the user isn’t actively engaged with the RDP client to respond to the MFA prompt, then the session hangs, seemingly indefinitely.

[Amy2]

Hi everyone,

It sounds like what you’re experiencing is the Secure Desktop locking user input due to the logon timeout. Windows only allows a fixed time limit for a complete login to occur. From the moment the Windows Logon Prompt appears until the Duo two-factor authentication completes MUST finish within that timeout period. The Windows OS will lockdown all user input after that point until a “new” login session is invoked. The login process and timeout settings are controlled entirely by Windows.

I know my reply is not super helpful in that I don’t have a solution to offer, other than to encourage users to complete authentication before the timeout as you’ve been doing. Hopefully you get some peace of mind from knowing it’s expected behavior.

[ApetersBessemer]

Thank you Amy. Education is the key with this issue.

[justinwon]

ISSUE

While authenticating to Duo via RDP, the Duo Prompt fails to load correctly. When this happens, you see the Duo Prompt flash on the screen briefly and then a blank screen appears.

RESOLUTION

To resolve, use version 4.2.0 or later of Windows Logon:

1. On the affected host(s), go to HKEY_LOCAL_MACHINE\SOFTWARE\Duo Security\DuoCredProv
2. Create a new DWORD InactivityTimeoutSeconds (unit: sec) and set a value in seconds.

Note that this does not affect how long you have to complete the authentication. Duo for Windows Logon (RDP) will always timeout after 60 seconds and you will have to log in again. This setting is only intended to reset the prompt in case it fails to load.

CAUSE

The issue is related to the hanging of a process that normally resolves when the timeout lapses.

ADDITIONAL INFORMATION

Once this timeout elapses, all processes for Windows Logon will be terminated and the user will be returned to the primary credential screen.  

This registry setting is also configurable via GPO