← Back to Blog

How to Use Offline MFA for Windows Logon and RDP

August 27, 2024 • Victoria Savage

Last reviewed: July 2026

This blog series showcases a variety of common and unique authentication scenarios, and recommended authentication solutions for each.

This installment explores three different authentication scenarios where offline MFA with Windows Logon is needed, as well as the six different solutions for these use cases. Check out one of our previous blogs about offline authentication with Windows Logon if you’re interested in learning more.

Scenario One: Offline Authentication with Smartphone

Maria is an employee at a software company, who occasionally has to travel on business to conferences and trade shows. She has a company issued smartphone and uses it with the LoginTC app for second factor authentication when logging into Windows Logon.

One day she arrives at a conference and wants to show one of her business partners a demo of her company’s product, but Maria’s laptop can’t connect to the conference hall Wi-Fi until she logs in.

How can Maria login to her laptop without first being connected to the internet?

Solution: Offline QR Code

In order to facilitate offline authentication, Maria’s IT team has set up Offline QR Code. This authentication method utilizes a QR code to generate one-time passwords in an authenticator app.

To use this method, Maria inputs her first factor credentials into her Windows machine and then selects “LoginTC App QR Scan” from the dropdown list of authentication methods. She opens her LoginTC app and selects “Scan QR Code”. This opens up the camera in her LoginTC app, and Maria can use her phone to scan the QR code shown on her computer. This generates a one time password in the app, which Maria inputs into the space provided.

She’s now securely logged in to her Windows machine with zero external communication required.

Solution: Third-party Authenticator App

Maria’s company could also allow end-users like her to use a pre-existing authenticator app, like Google Authenticator or Microsoft Authenticator, that Maria is already familiar with.

To use this method, Maria inputs her first factor credentials into her Windows machine and then selects “Software OTP” from the dropdown list of authentication methods. She opens her authenticator app, and inputs the 6-digit code into the space provided.

This method means Maria doesn’t need to download additional authenticator apps onto her device, and her company can still take advantage of LoginTC’s advanced functionality.

Solution: Offline Software Token

Maria’s company chooses to start using a fully on-premises authentication solution, such as LoginTC Managed. Included in this solution is an authenticator app that can generate one-time passcodes with zero external network connectivity required.

Maria uses this app to login to all of her protected services and applications. After inputting her first factor credentials, she selects “Software Token OTP” from the dropdown list of available methods and inputs the 6-digit code into the space provided.

Need to solve a similar MFA for Windows scenario? Talk to our team today.

Scenario Two: Offline Authentication without Smartphone

James works in a high-security environment for a company that builds and operates solar farms. To protect internal systems, external network connectivity is strictly prohibited. His company does not issue company smartphones to all staff.

To secure these systems, James’ company is introducing multi-factor authentication (MFA), but they want to ensure that no external connections are required for authentication and that smartphones are not used for authentication.

Solution: Passcode Grid

James’ IT team decides to implement Passcode Grid authentication for every employee at the company.

A passcode grid is a 5×5 grid with cells containing 3-character tuples. This grid is unique to James, and he can print out the passcode grid, or save it somewhere secure.

James logs into his Windows machine with his first factor credentials, and when prompted, selects “Passcode Grid” from the list of available authentication methods. Then in the spaces provided, James inputs the requested tuples and clicks “Log in”.

If James’ company switches to an on-premises MFA solution, a passcode grid can also be used for offline authentication with an on-premises deployment.

Solution: Hardware Token

James’ company could also choose to distribute hardware tokens to each employee for use both offline and online. Hardware tokens are physical authentication devices that generate 6 or 8-digit one time passwords.

After inputting his first factor credentials, James can select Hardware Token from the dropdown list, tap the button on the hardware token, and type in the number shown. This method can also be used with an on-premises deployment.

Solution: Security Key

Another way that James’ company can provide non-smartphone based offline authentication is using a Security Key. FIDO2 Security Keys offer strong, phishing-resistant authentication while being easy to use.

To use this method, James can select Security Key from the authentication drop down list, insert his security key, and simply tap the button to authenticate. This method is also available with an on-premises deployment.

Scenario Three: Emergency Offline Authentication

Philippe is on his way to a company retreat when his connecting flight gets canceled, and his bags are lost in transit. He needs to let his team know that he’s going to be late, but his company doesn’t allow for smartphone authentication, and his passcode grid is in his checked luggage.

How can Philippe log into his laptop to send an email to his team?

Solution: Offline Bypass Code

Philippe calls his company’s help desk, who instructs him to use an offline bypass code.

Philippe logs into his laptop with his username and password and, recognizing that he is not connected to the internet, the system prompts him for an offline bypass code. Philippe’s help desk relays the 9-digit code to him from where it’s listed in his user account, and he inputs the code to complete login.

Philippe can now find a secure Wi-Fi connection and get an email to his team.

Conclusion

Whether you need users to be able to authenticate offline with or without a smartphone, or in an emergency, there’s an authentication solution for your use case.

Want to see if LoginTC could solve your offline MFA needs?

Frequently asked questions about offline MFA for Windows Logon

Can I use MFA when my Windows laptop is offline?

Yes. LoginTC supports offline MFA for Windows Logon and RDP, so users can authenticate even without internet or cloud connectivity. The endpoint validates the second factor locally using a pre-registered credential. Authentication events sync to the central audit log when connectivity returns. This is critical for business travel, field work, air-gapped environments, and business continuity during network outages.

What offline MFA methods work with Windows Logon?

LoginTC supports six offline methods for Windows Logon: offline QR code (scan a code with the LoginTC app), third-party authenticator app codes (Google Authenticator, Microsoft Authenticator, or any TOTP app), offline software tokens (LoginTC’s own authenticator inside LoginTC Managed), passcode grid cards (printed 5×5 grid), hardware OTP tokens, and FIDO2 security keys. An offline bypass code is also available for emergency access.

How does offline QR code MFA work?

The user enters their Windows credentials and selects the QR code option from the authentication method list. The screen displays a QR code. The user opens the LoginTC app on their phone and scans the code, which generates a one-time password. The user types the code into Windows to complete sign-in. No internet is required, and no data is transmitted between the phone and the laptop except through the on-screen QR code scan.

Can I use offline MFA without a smartphone?

Yes. LoginTC supports three offline methods that do not require a smartphone: passcode grid cards, hardware OTP tokens, and FIDO2 security keys. Passcode grids are a printed 5×5 grid of three-character codes unique to each user. Hardware tokens display a rotating 6 or 8 digit code on demand. FIDO2 security keys are physical devices the user inserts and taps. All three methods work in fully offline and air-gapped environments.

What is a passcode grid for offline authentication?

A passcode grid is a 5×5 printed card of three-character codes unique to each user. During sign-in the user is prompted for specific cells (for example row 3 column 2, then row 1 column 4). The user reads the codes off their card and types them into Windows. Passcode grids require no smartphone, no batteries, and no network connectivity, which makes them ideal for high-security and air-gapped environments.

Do FIDO2 security keys work offline?

Yes. FIDO2 security keys perform the cryptographic authentication locally on the key itself, with no network dependency. During offline sign-in the user selects Security Key from the LoginTC prompt, inserts the key, and taps the button. The key generates a signed response that the Windows endpoint validates locally. This makes FIDO2 security keys the strongest phishing-resistant option that also works fully offline.

What is an offline bypass code and when should it be used?

An offline bypass code is a 9-digit code assigned to a user account for emergency use. If a user cannot access their normal authentication method (lost hardware token, lost passcode grid, phone unavailable) and cannot reach the internet, they can call the help desk for their bypass code and use it once to complete Windows Logon. Bypass codes are for emergencies only, typically single-use, and are logged for audit.

Does offline MFA work with a fully on-premises LoginTC deployment?

Yes. All six offline authentication methods work with both LoginTC Cloud and fully on-premises LoginTC Managed. In an on-premises deployment, every component (authentication server, admin console, and endpoint validation) runs inside your network. Combined with offline endpoint authentication, this means the entire authentication stack can operate without any external network dependency, which is critical for air-gapped and highly regulated environments.

← Back to Blog