In short: Duo Authentication for Windows Logon adds Duo MFA to local console and RDP logons on Windows 10, Windows 11 and Windows Server 2016 to 2025. It supports Duo Push and Verified Push, passcodes, offline access when there is no internet, and Passwordless OS Logon. Advantage adds PowerShell and SSH protection and Legacy AD Protection.
What Duo for Windows Logon protects
Duo installs as a Windows credential provider. After the user enters their Windows password, Duo asks for a second factor before the session opens. It can protect:
- Local console logons on laptops, desktops and servers
- Remote Desktop (RDP) logons, or RDP only if you choose that option at install, which suits servers admins reach remotely
- User Account Control (UAC) elevation, from version 4.1.0, optionally on its own without prompting at logon
Some logon types are not interactive and so do not show a Duo prompt, including Run as different user, PowerShell remoting, other non-interactive logons and Restricted Admin Mode RDP. Duo Advantage closes much of that gap with Windows command-line protection for PowerShell and SSH sessions, and Legacy AD Protection for other Active Directory logins.
Supported Windows versions and requirements
| Platform | Supported | Notes |
|---|---|---|
| Windows 10 and Windows 11 | Yes | Windows 11 from version 4.2.0 |
| Windows Server 2016, 2019, 2022 and 2025 | Yes, GUI installations only | Server Core is not supported. Server 2025 from version 5.0.0 |
| ARM64 devices | From version 5.2.0 | Needs Windows 10 version 1709 or later |
| Network | Outbound HTTPS to Duo | Version 6.0.0 and later need TLS 1.2 or later |
Microsoft ends support for Windows Server 2016 in January 2027, and Duo's support for its Windows applications on Server 2016 ends at the same time. Plan to upgrade those servers rather than rely on Duo continuing to work there.
Users can approve with Duo Push, Verified Duo Push, Duo Mobile passcodes, hardware token passcodes (including YubiKey OTP), SMS passcodes, phone call or bypass codes, depending on your policy. Security keys are supported for offline access only. Duo recommends version 5.0.0 or later for Verified Duo Push, which is included from Essentials.
Windows Logon does not support inline self-enrolment, so every user must already exist in Duo with an authentication device before Duo is switched on for their computer. Enrol users through another Duo application, a bulk enrolment email or directory sync first.
Offline access
Laptops are not always online. With offline access, included from Duo Essentials, users who have set it up can still complete MFA when the computer cannot reach Duo, using a passcode from Duo Mobile or a supported security key.
- By default up to five users can enrol for offline access on each computer; admins can change this through the registry, up to 50
- Each user can register only one offline authenticator; registering a second deactivates the first
- Admins can limit offline use to a number of logins or a number of days (up to 365) before the computer must reconnect
- Users who are not permitted or not enrolled for offline access fall back to the fail mode: let in without MFA if fail open is on, blocked if it is off
- Simple OTP passcode tokens and some security key brands cannot be used for offline access, and offline access over RDP is not officially supported, so test your devices first
Choosing between failing open (allowing logon without MFA when Duo is unreachable) and failing closed is one of the most important design decisions. Installers from version 4.3.0 fail closed by default (exe upgrades reset to fail closed, while msi upgrades keep the previous setting), and Duo suggests considering switching fail open off if you use offline access.
Passwordless OS Logon
From version 5.0.0, users can sign in to Windows without typing a password by approving a request in Duo Mobile on a phone near the computer. It is included from Essentials and is covered in more depth on our Duo Passwordless page. Requirements include:
- Windows 10 21H2 or later, or Windows 11, with TPM 2.0 enabled
- Bluetooth 4.0 or later on both the computer and the phone
- Duo Mobile activated for Duo Push on a supported iOS or Android version
- A physical device: it is not supported over RDP or in virtual machines
- Windows Logon 5.3.0 or later if you also want offline access for passwordless logon
Remembered devices and Duo Passport
To cut down on repeated prompts, remembered devices (from version 4.2.0, Essentials and above) add a "Remember me" option at local console logon. Once a user ticks it and completes Duo, they are not asked for Duo again when unlocking the workstation until the period set in your policy ends. RDP logons do not offer the option; Duo suggests an authorised networks policy instead where that is appropriate.
Duo Passport, in Duo Advantage and Premier, goes further. With Windows Logon 4.3.1 or later and Duo Desktop on the computer, and remembered devices enabled in policy, one Duo authentication is shared between Windows and Duo-protected browser and desktop apps. Passport can also work inside an RDP session on a server running Windows Logon 5.2.0 or later with Duo Desktop, although users still complete Duo when they log in to the remote machine.
Deployment and hardening
At scale, Windows Logon is installed silently with the application's keys and API hostname from the Duo Admin Panel using your software deployment tool, and options such as fail mode, offline access and UAC protection can be managed through the registry or Duo's Group Policy settings. Things we check on every project:
- Credential providers: installing Duo disables other logon tiles. Any provider you deliberately allow back, such as the Microsoft account provider, lets users sign in without Duo
- Safe Mode: Duo warns that console protection can be bypassed by restarting into Safe Mode, so follow Duo's hardening guidance and keep BitLocker recovery keys to hand for support
- Blank passwords: Windows users must have a password; accounts with blank passwords may not be able to log in after installation
- Upgrades: read the release notes before each upgrade and test on a pilot group, particularly where offline access or passwordless logon is in use
- Remote desktop gateways: if users connect through Microsoft RD Gateway, see Duo for RD Gateway; Duo recommends Windows Logon on the session hosts as the more flexible option
We plan fail modes and break-glass accounts, pilot with IT staff, then deploy by group. Contact us for Duo on your Windows estate.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Duo work with Windows 11?
Yes. Duo Authentication for Windows Logon supports Windows 11 from version 4.2.0, as well as Windows 10 and Windows Server 2016, 2019, 2022 and 2025. ARM64 devices are supported from version 5.2.0.
Can Duo protect RDP logons?
Yes. Duo for Windows Logon can protect both local and RDP logons, or RDP logons only. For connections through Microsoft RD Gateway, Duo also offers an RD Gateway plugin, though Duo recommends Windows Logon on the session hosts for more factor choice.
Does Duo Windows Logon work offline?
Yes, with offline access, which is included from Duo Essentials. Users who set it up can complete MFA with a Duo Mobile passcode or a supported security key when the computer cannot reach Duo. By default five users can enrol per computer.
What happens if Duo cannot be reached?
That depends on the fail mode. Failing closed blocks logons without MFA, while failing open lets users in without it. Installers from version 4.3.0 fail closed by default, and users enrolled in offline access can still log in with their offline passcode or security key.
Is Windows Server 2016 still supported by Duo?
Only until January 2027. Microsoft's support for Server 2016 ends then, and Duo's support for its Windows applications on Server 2016 ends at the same time, so plan upgrades now.
Which Duo edition do I need for Windows Logon?
Duo lists offline access, Passwordless OS Logon, Verified Duo Push and remembered devices for Windows Logon as Essentials, Advantage and Premier features. Windows command-line protection and Legacy AD Protection need Advantage or Premier, and Duo Passport needs Advantage or Premier. Contact us and we will match the edition to your needs.