3

I have a need for dual factor authentication on a windows 10 workstation that is NOT connected to a domain. The user accounts are local. I have not been able to find any solutions that will work without AD, is there any way to use smartcards, yubico keys or biometrics in conjunction with password/pin for logon? Please let me know if more information is needed.

Thanks!

Improve this question
7
  • You could potentially use BitLocker with PIN so you have the HD encryption level of protection, then you have the PIN level needed to boot, and lastly the correct username and password to sign on so that'd be three levels of protection I suppose depending on who you ask, etc. Please note you can have 10 levels of authentication and make it so you have 10 things to authentication against before it allows you access and unless the HD is encrypted, the data on the disk is not protected if someone had physical access to the machine. What exactly are you trying to protect or accomplish here?
    – Vomit IT - Chunky Mess Style
    Commented Apr 4, 2017 at 20:28
  • "is there any way to use smartcards, yubico keys or biometrics in conjunction with password/pin for logon?" - Yes; This is possible. but specifically Smartcard and a pin is possible. The other combinations are not.
    – Ramhound
    Commented Apr 4, 2017 at 20:29
  • It is a new requirement being passed down from leadership, how would I setup smartcard logon without a domain? I am not aware of how to associate a card with a local windows account
    – Josh Barton
    Commented Apr 4, 2017 at 22:01
  • A smartcard solution seems possible, requiring mostly the local installation of Certificate Services. The rest involves the physical cards, the readers, and the vendor's software. Smartcards may replace the logon, and the vendor's software can also demand password/PIN specific to the card. Without the DC the annoyance would be the individual installation per computer. I think Yubico does what you want, and you can check directly with them.
    – harrymc
    Commented Sep 22, 2017 at 8:11
  • @dylanweber I did want to at least show you my answer here superuser.com/questions/1104810/… from a year or so ago I wrote but look over the Configuring Local Group Policy Settings for BitLocker section for getting BitLocker PIN configuration setup. Just use the fingerprint authentication built in functionality and be done with your two levels to authenticate. With BitLocker get both PIN and encryption and then use Wave or whatever fingerprint config software comes with your machine (model).
    – Vomit IT - Chunky Mess Style
    Commented Sep 23, 2017 at 5:45

3 Answers 3

Reset to default
4
+50

According to this TechNet discussion it is not possible to require two factors for logon using Windows Hello (the logon service for biometrics on Windows) on standalone systems (outside of Active Directory). Factors are all either/or such as fingerprint or PIN.

It might be possible to do this with third party software if it installs itself as a GINA DLL and can read the biometric or other factor and requires a PIN in addition. I'm unsure though if Windows 10 still supports alternative logons via GINA DLLs. You would also need to find a third party GINA DLL program which was able to read your second factor and had the option to require a pin in addition.

There is a third party GINA DLL provider which is open source and may be able to be made to meet your needs called pGINA but it is unclear whether it will work in Windows 10 or is still being actively developed.

Improve this answer
0

Yes. I'm using both a fingerprint and a Yubikey with Windows 10. Or you could use password plus Yubikey. Just install the Yubikey logon tool that requires the key be installed when you login for your second factor PIV card.

Improve this answer
0

This is now possible with Windows Hello for Business. Despite the name, the feature is available to all users with Windows Pro (10 or 11). You'll need to be confident modifying group policy

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Aug 1 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .