Windows sign-in with a second factor: overview

The Windows agent adds a second factor to console sign-in, unlock, remote desktop and, optionally, administrator prompts. The person types their Windows password and then approves on their phone by typing the number the screen shows, or uses their authenticator-app code.

What is installed?

An MSI (AuthGuardDesktop-x64.msi) for Windows 10, Windows 11 and Windows Server (x64), with two components:

The computer authenticates with its own key, in the TPM when there is one. It works through TLS-inspecting proxies.

Where is it managed?

«Manage» › «Computers». The item appears only when the service has Windows sign-in turned on; otherwise: «Windows sign-in is not available on this server.»

Prerequisites

1. «Allow phone approvals» on under «Manage» › «Security», and people with a linked phone (or a TOTP code as fallback).
2. An install token. See Install tokens.
3. Windows accounts mapped to people. See Map Windows accounts.
4. The computer policy reviewed. See Offline and break-glass policy.

Recommended rollout order

1. Test on a pilot computer with the break-glass account defined.
2. Deploy through GPO or Intune to a small group, in the «Canary» update ring.
3. Extend to the rest.

What is recorded?

Every attempt appears in the computer's details under «Sign-ins» (who, when, how, outcome) and in the organization's audit.