I'm trying to configure YubiKey 5 devices for MFA on standalone Windows machines as part of a CMMC Level 2 effort. The Yubico Login for Windows option isn't suitable because the YubiKey touch interaction does not tunnel properly through RDP. I've also enabled smart-card and WebAuthn redirection in the RDP client and adjusted the server policies for smart-card and plug-and-play device redirection, but that hasn't resolved the issue. Has anyone found a reliable way to use YubiKeys with local Windows accounts, particularly for remote logons?
4 Answers
Duo Authentication for Windows Logon and RDP may be a practical route. It supports local Windows accounts and can use a YubiKey 5 as the second factor, similar to a Duo Push approval. This avoids relying on the YubiKey touch operation being tunneled directly through the RDP session.
If Duo is used, check whether its credential-provider settings are preventing Windows Hello for Business providers from loading. A credential-provider whitelist registry setting may allow the needed Windows Hello providers to function alongside Duo instead of being blocked by the Duo logon provider.
Enabling smart-card and WebAuthn redirection is worth checking, but it won’t overcome the underlying authentication limitations here. Smart-card logon generally depends on domain or Kerberos-based authentication, and FIDO2 authentication isn’t supported directly for standalone local Windows accounts. That’s why the redirection and group-policy changes may have had no effect.
I enabled those settings on both the client and server, including smart-card and plug-and-play redirection, but the behavior stayed the same.
It may be worth reconsidering whether these machines can be joined to a domain or another centralized identity system. YubiKeys configured as PIV smart cards tend to work much more reliably in a domain environment, whereas direct YubiKey authentication for local accounts has significant limitations.
I’ll investigate the Duo approach. Thanks for pointing me in that direction.