How can I use a YubiKey for MFA with local Windows accounts over RDP?
Asked by
MellowPine42
I'm trying to configure YubiKey 5 devices for MFA on Windows local accounts to help meet CMMC Level 2 requirements. The Yubico Login for Windows option hasn't worked for our setup because the key's touch interaction doesn't tunnel properly over RDP. I've enabled smart-card and Windows Hello/WebAuthn redirection in the RDP client and also tried the related server Group Policy settings, but that didn't resolve the issue. Has anyone found a reliable way to use YubiKeys with local accounts, particularly when connecting through RDP?
Answers
We use Duo for Windows Logon and RDP with a YubiKey configured as the second factor. If Duo’s credential provider conflicts with Windows Hello for Business, a Credential Provider whitelist registry setting can be used to allow the required Windows Hello providers to remain available.
Reply to this answer
RDP redirection settings are worth checking, but they may not solve the underlying limitation. Enabling smart-card, Windows Hello, WebAuthn, and plug-and-play redirection on both the client and server doesn’t necessarily make FIDO2 authentication work with a local Windows account. Smart-card and FIDO2 authentication have different requirements, and local-account support can be limited.
Reply to this answer
Duo Authentication for Windows Logon and RDP may be the simplest route. It supports local Windows accounts and can use a YubiKey 5 as the second factor, similar to approving a Duo Push. That avoids depending on the YubiKey touch event being passed through the RDP session.
MellowPine42: I’ll investigate the Duo approach. Thanks for pointing me in that direction.
Reply to this answer
If possible, consider joining the machines to a domain or another centralized identity system. YubiKeys issued as PIV smart cards tend to work more cleanly in a domain-based setup, whereas using FIDO2 directly with standalone local accounts—especially over RDP—has more constraints.
Reply to this answer
Add your answer
Answers are reviewed before publication.
NorthVale5: That whitelist detail is useful, especially if installing Duo causes the Windows Hello sign-in options to disappear.