Requesting Windows 2FA advice

Posted by msabeln@reddit | sysadmin | View on Reddit | 16 comments

I am the IT consultant for a small, impoverished rural public school district and I need to identify a suitable two- or multi-factor authentication solution for our Windows 10 Pro PCs and 11 Pro laptops for insurance and soon-to-be mandatory State cybersecurity mandates. We have a good hardware infrastructure, thanks to generous Federal grants, but extremely limited funding for expenses. Furthermore, I only work three days a week with a multitude of other tasks, so my time for research and deployment is highly constrained. We have a Windows Server 2019 PDC for the PCs. We also have the free Google Workspace for Education edition, and MFA was simple to implement on *that*. I’m looking for a *free* 2FA or MFA solution for Windows, that will work with both on-premise PC and most especially remote laptops. It seems that most solutions require Azure, which is not really a solution for us but I’m willing for someone to change my mind. I keep hearing that Microsoft does offer free educational services but it is hard to find clear, unambiguous information. Windows Hello could be a solution, but online documentation is sometimes contradictory.

Reply to Post

16 Comments

[-]

AlivePop6706@reddit

Hey there! I volunteered at my son's school and we chose the CodeB Credential provider because of its diverse token support (mobile, NFC, 2FA, TOTP, etc.). They're super supportive of educational institutions and offer significant discounts on their Perpetual License. Might be worth checking out: [**https://www.win-logon.com**](https://www.win-logon.com/) Best of luck!

[-]

zm1868179@reddit

If you're in a school and your school system issues student IDs you could deploy hid crescendo c2300 cards be serve dual purpose and can be used for Access control if you have that as well as FIDO2 tokens. If using that your users wouldn't need username and password they just use their staff / due to IDs and the pin number associated with it. Windows hello by itself is 2fa. It works a lot differently than people think it is but it does qualify as 2fa if someone was to steal a laptop it would take them over 2 years to be able to guess a four digit PIN number because a TPM hammering more than likely way before that time the device is going to be reported as missing and you can remove it which removes the hello credentials from the Azure side to the second that PC hits the internet and it checks in with Azure it's going to realize that it's been deactivated which will invalidate that computer and make it useless even if they do get into it. 2FA by definition is something you have plus something you know the laptop being the thing you have and the pin number being the thing you know or in the case of a fido token the physical security key and the pin number even if you figured out the pin number it's useless without the very specific device that the pin number is tied to either the laptop or the security key.

[-]

msabeln@reddit (OP)

Yeah I was hoping not to use Azure for a couple of reasons: impoverished rural school district and extremely limited IT resources. We do have an on-premise DC.

[-]

zm1868179@reddit

Have you reached out to Microsoft education gets deep discounts sometimes even free access to services. As far as free solution it most likely won't exist you will need azure for security keys to function or duo which will require you to pay for duo or the correct M365 Edu licenses. Windows hello for business requires azure to function on prem by itself doesn't exist.

[-]

msabeln@reddit (OP)

Egads I only work three days a week there and have a ton of other stuff to do. 🙁

[-]

thesilversverker@reddit

They can have it right, easy, or cheap, pick 1.

[-]

msabeln@reddit (OP)

I frequently use a similar quote, but it allows you to pick two of the three.

[-]

thesilversverker@reddit

Market conditions have worsened unfortunately :(

[-]

sithanas@reddit

If your computers have support for two factors (IR cams or fingerprint readers—you can get external fingerprint readers pretty cheap) then Windows Hello for Business would be your quickest solution. You can set the GPO for it to require two factors and in the list of acceptable factors require a bio option and a PIN. You could also make a Bluetooth beacon device (like a paired phone) into a second factor.

[-]

Discipulus96@reddit

As far as I know there is nothing like what you're asking for free. The first non free option I'd recommend is duo. It would be easy to deploy and works very well especially considering your limited hours of availability. Windows hello is kind of a grey area. It's not exactly 2fa in the traditional sense and depending on your insurance they might not consider it a valid option. For example, if a laptop gets stolen all you need to know is the users pin to unlock it. I'm sure somebody will chime in with a free software they know about, but be wary, usually the free software requires a lot more labor to setup and maintain and support compared to something very mature like duo. I'd suggest your best bet is to inform your managers that the industry standard does not currently have a good free option and trying to patch together something would potentially cause more problems than solve.

[-]

msabeln@reddit (OP)

Our laptops have cameras, if that helps, but not the PCs.

[-]

cetrius_hibernia@reddit

They have to be IR cameras for windows hello

[-]

carat72@reddit

I will second all of this, I went down this rabbit hole the last time we had to renew insurance and all the free options are more geared toward setting up a single PC with mfa, and does not scale to an org. We landed on duo, the essentials which is all you need for mfa, is $3/u/m and is well worth that price for how easy it is to setup and manage. Plus lots of cloud apps let you use duo for mfa in their apps as well. Duo is now the only authenticator our users have to install vs the three they used to have.

[-]

Top-Examination-6800@reddit

You can use biometric authentication for windows hello. You can also use yubikey for authentication as well. If not, then you would need to explore options like DUO.

[-]

HankMardukasNY@reddit

Duo

[-]

AutoModerator@reddit

Much of reddit is currently restricted or otherwise unavailable as part of a large-scale protest to changes being made by reddit regarding API access. /r/sysadmin has made the decision to not close the sub in order to continue to service our members, but you should be aware of what's going on as these changes will have an impact on how you use reddit in the near future. More information can be found [here](https://www.reddit.com/r/Save3rdPartyApps/comments/1476ioa/reddit_blackout_2023_save_3rd_party_apps/). If you're interested in alternative r/sysadmin communities during the protests, you can join our [Discord](https://discord.gg/sysadmin) or IRC (#reddit-sysadmin on libera.chat). *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/sysadmin) if you have any questions or concerns.*