Multi-Factor Authentication (MFA) for Windows Logon and Remote Desktop (RDP) 2FA

 
Last Updated: July 29, 2026

Overview of MFA for Windows Logon and RDP

The LoginTC Windows Logon and RDP Connector integrates natively with Windows Server and Windows Client operating systems. Local access and remote access can both be protected with LoginTC MFA.

LoginTC MFA works online and offline, and can be configured to control which users or groups are challenged with MFA.

Explore how LoginTC integrates with Windows Logon and RDP below.

Windows MFA User Experience

After entering the username and password, the user is shown a selection of second factor options. The user clicks a button to receive a LoginTC push notification, authenticates and is logged in.

• Remote Desktop Push
• Console Logon Push
• Software OTP
• Offline Passcode Grid
• Offline QR Scan

Looking to protect other Microsoft services with MFA? See related connectors below.

How MFA for Windows Works Architecture

Windows 2FA/MFA Flow

1. A user attempts access with username / password
2. The username / password is verified against an existing first factor directory (i.e. Active Directory)
3. An authentication request is made to LoginTC Cloud Services
4. Secure push notification request sent to the user’s mobile or desktop device
5. User response (approval or denial of request) sent to LoginTC Cloud Services
6. The LoginTC Windows Logon and RDP Connector validates the user response
7. User is granted access to Windows laptop / desktop

System Requirements for LoginTC Two Factor Authentication (2FA/MFA)

Supported Windows Server versions:

• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Supported Windows Client versions:

• Windows 10 (version 1607 or later)
• Windows 11

Additional Requirements:

• LoginTC Admin account
• 64-bit operating system (x64 or ARM64 architecture)

Create Application for Windows Logon 2FA/MFA

Start by creating a LoginTC Application for your Windows 2FA. An Application represents a service (e.g. RDP access to your Windows infrastructure) that you want to protect with LoginTC.

Create a LoginTC Application in LoginTC Admin, follow Create Application Steps.

If you have already created a LoginTC Application for your Windows 2FA, then you may skip this section and proceed to Installation.

Windows Installer

Install the LoginTC Windows Logon and RDP Connector.

1. Download the latest version of the LoginTC Windows Logon and RDP Connector x64 or ARM64
2. Run the installer file as a privileged administrator user.
3. Press Next.
4. Read the License Agreement and press Next if you accept the terms.
5. Change the LoginTC API Host only if you have a private enterprise LoginTC deployment. Press Next:
6. Enter your LoginTC Application ID and Application API Key. These values are found on your LoginTC Admin Panel (see Managing your Application. Press Next.
7. Choose which logon types should be prompted for LoginTC. Press Next.
   
   

   Protecting Local Logons
   Note: The LoginTC Windows Logon and RDP Connector takes effect at the next sign-in — no restart of the Windows host is required. See Which Windows logon prompts does LoginTC protect? for more information.

8. Press Install.
9. Press Finish

The LoginTC Windows Logon and RDP Connector is now installed. It starts protecting logins at the next sign-in — no restart is required.

Usage

Your users may login in several ways. This chapter details the user experience for each interaction.

RDP Login

When a user launches their RDP client they will be presented with the standard login sequence. After successfully logging in with their username and password, they are shown the LoginTC login page on the remote host. Various login options for the second-factor LoginTC authentication are presented. Once successfully authenticated with LoginTC the user is logged into the host.

Local Logon

After successfully logging in with their username and password, they are shown the LoginTC login page on the local host. Various login options for the second-factor LoginTC authentication are presented. Once successfully authenticated with LoginTC the user is logged into the host.

Offline Logon

If the host does not have internet connectivity then after successfully logging in with their username and password, the user is shown options for logging in offline.

There are a few methods of offline authentication:

1. QR Scan Authentication. The user launches the LoginTC App, select Settings > Scan QR Code and then scan the displayed QR Code. If the scan is successful a 6-digit code is displayed for the user to enter and authenticate. QR Scan Authentication is only supported for LoginTC iOS App and LoginTC Android App.
2. Passcode Grid. The user enters the 3-letter tuples corresponding to their own passcode grid. If the response is accurate they are logged in. To learn more see: Passcode Grids.
3. Security Key. The user can insert a Security Key and press it to authenticate. If the security key is the right one they are logged in. To learn more see: Security Keys.
4. Hardware Token. The user can use the same Hardware Token assigned to them to login offline. To learn more see: Hardware Tokens.
5. Authenticator App. The user can use the same Authenticator App assigned to them to login offline. To learn more see: Authenticator App.
6. Offline Bypass Code. The user must enter a 9-digit Offline Bypass Code which is provided to them by their support desk. Codes are regenerated each time the user logs in online and can be found on the users page in the LoginTC Admin Panel under Offline Bypass Codes.

UAC (Run as administrator)

When LoginTC for UAC is enabled, the user requesting elevated privileges is prompted to authenticate with LoginTC:

1. User right clicks on an application and clicks on Run as administrator
   
2. User is prompted to enter the credentials of an administrator
   
3. User is prompted to perform LoginTC authentication for that particular administrator
   

Remembered Devices

Enforce a policy to allow a Windows device to be remembered for specified duration until the user signs out of their machine, reboots, logs in offline or changes networks. This feature applies to console unlock logons.

Remembered devices also works for offline logons.

Command line Installation

You may also install the LoginTC Windows Logon and RDP Connector from the Command Prompt. This is particularly useful when deploying to a large number of machines.

To install from the Command Prompt:

1. Find the Command Prompt in the Start menu
2. Right Click and select “Run as administrator”
3. Enter the following command (refer to the table below for configuration options)

msiexec /qn /i logintc-windows-logon-connector-2.0.0.0-x64.msi ^
    LOGINTC_APPLICATION_ID="YOUR_APPLICATION_ID" ^
    LOGINTC_APPLICATION_API_KEY="YOUR_APPLICATION_API_KEY" ^
    /l*v logintc-windows-logon-install.log

Only the Application ID and Application API Key are required: the API host defaults to cloud.logintc.com and LoginTC is enforced for remote (RDP) logons by default. A complete example:

msiexec /qn /i logintc-windows-logon-connector-2.0.0.0-x64.msi ^
    LOGINTC_API_HOST="cloud.logintc.com" ^
    LOGINTC_APPLICATION_ID="YOUR_APPLICATION_ID" ^
    LOGINTC_APPLICATION_API_KEY="YOUR_APPLICATION_API_KEY" ^
    LOGINTC_ENABLE_RDP="1" ^
    LOGINTC_ENABLE_CONSOLE="0" ^
    LOGINTC_ENABLE_UAC="0" ^
    LOGINTC_BYPASS_USERS=".\support,.\localadmin"

Property	Meaning	Example
LOGINTC_APPLICATION_ID	The 40-character Application ID (found in the LoginTC Admin Panel)	5de7c5b82a6972...
LOGINTC_APPLICATION_API_KEY	The 64-character Application API Key (found in the LoginTC Admin Panel)	5R2EgzXBOHx3RN...
LOGINTC_API_HOST	(Optional) The LoginTC API host. Up to 4 comma-separated hosts can be configured for failover. Change only if you have a private enterprise LoginTC deployment. Default: cloud.logintc.com	cloud.logintc.com
LOGINTC_ENABLE_RDP	(Optional) 1 to enable LoginTC for remote (RDP) logins, or 0 to disable. Default: 1	1
LOGINTC_ENABLE_CONSOLE	(Optional) 1 to enable LoginTC for local console logins, or 0 to disable. Default: 0	0
LOGINTC_ENABLE_UAC	(Optional) 1 to enable LoginTC for UAC elevation prompts, or 0 to disable. Default: 0	0
LOGINTC_CHALLENGE_GROUPS	(Optional) Groups whose members will be challenged. Refer to Challenge Groups for more information.	*\support
LOGINTC_BYPASS_GROUPS	(Optional) Groups whose members will be bypassed. Refer to Bypass Groups for more information.	*\support
LOGINTC_CHALLENGE_USERS	(Optional) Users which will be challenged. Refer to Challenge Users for more information.	CORP\john.doe
LOGINTC_BYPASS_USERS	(Optional) Users which will be bypassed. Refer to Bypass Users for more information.	.\localadmin
LOGINTC_CREDENTIAL_PROVIDER_ALLOWLIST	(Optional) Comma-separated CLSID GUIDs of additional credential providers to keep enabled alongside LoginTC.	{D6886603-9D2F-4EB2-B667-1971041FA96B}
LOGINTC_MACHINE_ID	(Optional) Device identifier used for online and offline authentication. Generated automatically when omitted. On an upgrade the existing value is always kept.	3f9a2c
LOGINTC_FORCE_AUTO_PUSH	(Optional) 1 to automatically send a push notification when the user reaches the LoginTC prompt. Default: 0	1
LOGINTC_DEBUG	(Optional) 1 to enable verbose debug logging to the LoginTC event log. Default: 0	0

At least one of LOGINTC_ENABLE_RDP, LOGINTC_ENABLE_CONSOLE or LOGINTC_ENABLE_UAC should be enabled. Values containing spaces must be quoted.

Logging

The LoginTC Windows Logon and RDP Connector logs events to the Microsoft Event Viewer under Applications and Service Logs → LoginTC. LoginTC Windows Logon and RDP Connector event logs are helpful in debugging issues. Verbose debug logging can be enabled by installing with LOGINTC_DEBUG="1" (or by setting the Debug registry value to 1).

Passthrough MFA

There are several ways to specify which set of users should be challenged with LoginTC second-factor authentication, and which ones will not. This is often useful when testing and when rolling out a deployment to minimize the impact on others or to maintain operational access to the hosts. Bypass settings are configured on each host where the LoginTC Connector is installed for your Windows multi-factor authentication (2FA/MFA).

Challenge Groups

The ChallengeGroups attribute is a comma delimited list of groups for which all member users will be challenged with LoginTC second factor authentication. When either ChallengeGroups or ChallengeUsers is specified both BypassGroups and BypassUsers is ignored. If the user is not part of any challenge group, they are logged in without LoginTC two factor authentication (2FA/MFA).

Instructions to set ChallengeGroups attribute:

1. Launch regedit (Registry Editor).
2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Cyphercor > LoginTC Windows Logon Connector
3. Click to modify the ChallengeGroups field
4. Enter a comma delimited list of challenge groups, see format:

Format	Meaning	Example
*\groupname	All groups part of any domain that have name groupname.	*\RemoteMFAUsers
DOMAIN\groupname	Groups with name groupname belonging to DOMAIN domain.	DOMAIN\RemoteMFAUsers
groupname	Local group with name groupname.	RemoteMFAUsers
SID	Group security identifiers (SIDs)	S-1-5-21-...

5. Click OK to save changes.

Bypass Groups

The BypassGroups attribute is a comma delimited list of groups for which all member users will not be challenged with LoginTC second factor authentication. When either ChallengeGroups or ChallengeUsers is specified both BypassGroups and BypassUsers is ignored. If the user is not part of any bypass group, they are challenged with LoginTC second factor authentication.

Instructions to set BypassGroups attribute:

1. Launch regedit (Registry Editor).
2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Cyphercor > LoginTC Windows Logon Connector
3. Click to modify the BypassGroups field
4. Enter a comma delimited list of bypass groups, see format:

Format	Meaning	Example
*\groupname	All groups part of any domain that have name groupname.	*\RemoteMFAUsers
DOMAIN\groupname	Groups with name groupname belonging to DOMAIN domain.	DOMAIN\RemoteMFAUsers
groupname	Local group with name groupname.	RemoteMFAUsers
SID	Group security identifiers (SIDs)	S-1-5-21-...

5. Click OK to save changes.

Challenge Users

The ChallengeUsers attribute is a comma delimited list of users which will be challenged with LoginTC second factor authentication. When either ChallengeGroups or ChallengeUsers is specified both BypassGroups and BypassUsers is ignored. If the user does not match any challenge user, they are logged in without LoginTC two factor authentication (2FA/MFA).

Instructions to set ChallengeUsers attribute:

1. Launch regedit (Registry Editor).
2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Cyphercor > LoginTC Windows Logon Connector
3. Click to modify the ChallengeUsers field
4. Enter a comma delimited list of challenge users, see format:

Format	Meaning	Example
*\username	All accounts, local or on any domain that have username username.	*\john.doe
.\username	Local account with username username.	.\john.doe
DOMAIN\username	Domain account with username username belonging to DOMAIN domain.	CORP\john.doe

5. Click OK to save changes.

Bypass Users

The BypassUsers attribute is a comma delimited list of users which will not be challenged with LoginTC second factor authentication. When either ChallengeGroups or ChallengeUsers is specified both BypassGroups and BypassUsers is ignored. If the user does not match any bypass user, they are challenged with LoginTC two factor authentication (2FA/MFA).

Instructions to set BypassUsers attribute:

1. Launch regedit (Registry Editor).
2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Cyphercor > LoginTC Windows Logon Connector
3. Click to modify the BypassUsers field
4. Enter a comma delimited list of bypass users, see format:

Format	Meaning	Example
*\username	All accounts, local or on any domain that have username username.	*\john.doe
.\username	Local account with username username.	.\john.doe
DOMAIN\username	Domain account with username username belonging to DOMAIN domain.	CORP\john.doe

5. Click OK to save changes.

FAQ

Which Windows logon prompts does LoginTC protect?

The LoginTC Windows two factor authentication (2FA/MFA) protects:

• Remote Desktop Logins
• Local Logins
• Run as administrator

The LoginTC Windows two factor authentication (2FA/MFA) does not protect:

• “Run as different user”
• RDP Restricted Admin Mode
• Pre-Logon Access Providers (PLAPs) such as Always On VPN
• Noninteractive logins (e.g. batch process, mapping network drive, logon as a service, scheduled tasks)
• PowerShell cmdlets: “Get-Credential”, “Enter-PsSession”, “Invoke-Command”

Does Windows logon work in Safe Mode?

By default, Windows disables all credential providers except the built-in password credential provider when in Safe Mode. If you wish to enable LoginTC in Safe Mode, you can do so by following these instructions:

1. Open the Registry Editor
2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Authentication > Credential Providers
3. Create a key DWORD entry named ProhibitFallbacks with the value 1

Does the LoginTC Windows Logon and RDP Connector support Microsoft/Live accounts?

No, the connector does not support Microsoft/Live accounts.

Can the installer be deployed automatically

Yes, commandline installation is supported: Command line installation

An end to end sample guide on deploying using Group Policy: Automatic LoginTC Windows Logon and RDP Connector Deployment.

Upgrade

As of version 2.0.0, the LoginTC Windows Logon and RDP Connector upgrades in place: run the newer installer on a host with an older version installed and follow the prompts. The existing configuration is preserved, including when upgrading from a 1.x version.

To upgrade silently from the Command Prompt:

msiexec /qn /i logintc-windows-logon-connector-2.0.0.0-x64.msi

Any configuration property supplied on the command line is validated and applied; all other settings are preserved.

Uninstallation

To uninstall the LoginTC Windows Logon and RDP Connector, simply navigate to the Add or remove programs in the Windows Control Panel, find LoginTC Windows Logon and RDP Connector in the list and follow the prompts.

You may also uninstall the LoginTC Windows Logon and RDP Connector from the Command Prompt. This is particularly useful when deploying to a large number of machines.

To uninstall from the Command Prompt:

1. Find the Command Prompt in the Start menu
2. Right Click and select “Run as administrator”
3. Enter the following command

msiexec /x logintc-windows-logon-connector-2.0.0.0-x64.msi /qn

NOTE: The msi file has to be the same version and architecture that’s installed (use the arm64 msi on ARM64 machines).

Troubleshooting Related Connectors

You may also be interested in our:

• Remote Desktop Web Access (RD Web) 2FA Connector
• Remote Desktop Gateway (RD Gateway) 2FA Connector
• Office 365 2FA Connector
• Outlook Web App (OWA) 2FA Connector
• Windows Server 2012 2FA Connector
• Windows Server 2016 and 2019 2FA Connector