I would like to restrict access to our windows Servers using a hardware keys additionally to passwords.

Is it possibly to restrict connecting to (local) RDP to specific U2F Fido keys? And/or to restrict direct logon to servers so the user needs the U2F/Fido key, too?

Or are there other hardware like smart cards which could be used to restrict logon to computers?

  • 4
    Using Forefront Identity Manager and Active Directory, you can set up authentication via Smart Card or whatever. Don’t know about any details though. – Daniel B Aug 7 '18 at 12:53

Microsoft provides technical details on Smart Card authentication.

Smart Card Technical Reference (Windows 10, Windows Server 2016) | Microsoft Docs

Smart cards are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account.

For a third-party, two-factor authentication solution, consider Duo Security which implements two-factor authentication for Windows using various authentication methods, including U2F.

Also, consider other solutions quickly found online:

| improve this answer | |
  • 2
    Smart cards might be the way to go - but the technical reference is very abstract. Is there a good documentation how to use smart Cards somwhere? – Sam Aug 16 '18 at 8:51
  • No user guides how to roll out smart cards anywhere? – Sam Aug 20 '18 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.