cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1907
Views
0
Helpful
2
Replies

Proof that Duo is set to pop up at windows logon

Jhayden_Cofield
Level 1
Level 1

Hello. Im currently working on a FedRamp project that is using Duo for MFA. Can anyone tell me where i can find evidence that Duo is set up to pop up at a servers logon screen? Is there a configuration setting or a registry key that can prove this?

2 Replies 2

kd0071
Level 1
Level 1

Hi,
I’d wait for someone who works for Duo to give you an official answer but I think the registry keys in HKLM\SOFTWARE\Duo Security\DuoCredProv\ are proof.

DuoKristina
Cisco Employee
Cisco Employee

You can show it’s installed and configured via the registry values at HKLM\SOFTWARE\Duo Security\DuoCredProv or HKLM\Software\Policies\Duo Security\DuoCredProv (the second location is where the effective config lives if you used GPO in your org to configure Duo).

For example, if you want to show that it is configured to require Duo MFA at both RDP and local console logons, you could check that the RdpOnly value at those locations is set to 0.

You can see details for all GPO configurable registry settings in the Windows Logon GPO download linked from here.

ETA: I came from an environment that sounds like yours, where we had regular audits of server security settings, including 2FA (not Duo, but another vendor’s solution that had a client installed on the server). For all the various bits of security software I would gather registry and RSoP info for the in-scope servers and prepare a report for the auditors, but they’d spot-check by choosing 20-30 systems and have me actually log in to demonstrate the controls from the report were effective.

Duo, not DUO.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Quick Links