I'm trying to configure YubiKey 5 devices for MFA on Windows local accounts to help meet CMMC Level 2 requirements. The Yubico Login for Windows option hasn't worked for our setup because the key's touch interaction doesn't tunnel properly over RDP. I've enabled smart-card and Windows Hello/WebAuthn redirection in the RDP client and also tried the related server Group Policy settings, but that didn't resolve the issue. Has anyone found a reliable way to use YubiKeys with local accounts, particularly when connecting through RDP?
4 Answers
If possible, consider joining the machines to a domain or another centralized identity system. YubiKeys issued as PIV smart cards tend to work more cleanly in a domain-based setup, whereas using FIDO2 directly with standalone local accounts—especially over RDP—has more constraints.
Duo Authentication for Windows Logon and RDP may be the simplest route. It supports local Windows accounts and can use a YubiKey 5 as the second factor, similar to approving a Duo Push. That avoids depending on the YubiKey touch event being passed through the RDP session.
RDP redirection settings are worth checking, but they may not solve the underlying limitation. Enabling smart-card, Windows Hello, WebAuthn, and plug-and-play redirection on both the client and server doesn’t necessarily make FIDO2 authentication work with a local Windows account. Smart-card and FIDO2 authentication have different requirements, and local-account support can be limited.
We use Duo for Windows Logon and RDP with a YubiKey configured as the second factor. If Duo’s credential provider conflicts with Windows Hello for Business, a Credential Provider whitelist registry setting can be used to allow the required Windows Hello providers to remain available.
That whitelist detail is useful, especially if installing Duo causes the Windows Hello sign-in options to disappear.
I’ll investigate the Duo approach. Thanks for pointing me in that direction.