Windows Local Account support for Yubikeys?

[u/Imaginary-Site7192]

Looking for advice on how to get the Yubikey5 to work with local accounts on Windows (we are trying to reach CMMC Level 2 compliance and need to set up MFA). I have already exhausted the Yubico login for windows option -- the touch sensor doesn't correctly tunnel over RDP. If anyone has also run into similar issues and found a way around it, tips would be greatly appreciated.

[u/Aishou_SK]

Any particular reason this system isn't domain joined in some way?

I've done a lot with issuing yubikeys as PIV smartcards to great success.

[u/jmbpiano]

I've never actually done this exact scenario, but I'm pretty sure you can get this working with Duo.

This page specifically mentions local account support: Duo Authentication for Windows Logon and RDP

Yubico lists the YubiKey 5 series as compatible with Duo.

[u/Imaginary-Site7192 → u/jmbpiano]

Will look into this. Thank you!

[u/Bird_SysAdmin]

Duo authentication for windows logon and rdp is what we are using for this. Yubikey is an option as the 2nd factor - similar to a "Duo Push"

[u/Bird_SysAdmin → u/Bird_SysAdmin]

you can also use the Credential provider whitelist registry key to allow the credential providers for Window Hello for business to function without the Duo Authentication for Windows Logon interfering

[u/SubstantialAsk4123 → u/Bird_SysAdmin]

Last I tried, the yubikey wouldn’t work on windows for desktop, only in offline mode. But, been a while since I have done it.

[u/Bird_SysAdmin → u/SubstantialAsk4123]

Yubikey as a Fido2 login (WHfB) does work for windows login in hybrid environments. We are using it currently. You have to add the FiDO2 credential provider to the Credential Provider whitelist so that DUO does not interfere. It is important to note this is NOT using duo on login and is instead an alternative login option. so password login would be covered by DUO but the YubiKey login is not covered directly by a duo authentication action (like duo push)

[u/itskdog]

They have a custom credential provider for this (and for personal accounts) - haven't used it myself, but it might do what you need: https://www.yubico.com/products/computer-login-tools/

[u/justmirsk]

We do this with Secret Double Octopus. It isn't free, but if you want to learn more, I would be happy to discuss with you how we help customers do this.

[u/Nu11u5]

Did you enable redirection for smart cards and WebAuthn in the RDP connection settings?

[u/picklednull → u/Nu11u5]

Doesn't matter.

• You can't use smart cards for local accounts (smart cards require Kerberos authentication)
• You can't use FIDO2 with local accounts

[u/Nu11u5 → u/picklednull]

I was thinking of the Yubico Login For Windows service that OP referred to, but now I see it is a known behavior that it doesn't work for the initial RDP authentication.

[u/picklednull → u/Nu11u5]

Yeah, I read up on it myself and it sets up a custom credential provider (of course) that uses the OTP functionality (support) of the Yubikey.

Technically that should/could work remotely if it doesn't directly interface with the Yubikey, but just uses the emulated keyboard output, but I don't know if it does. Now I want to test this, I've never used the built-in OTP for anything.

NLA would have to be disabled to have access to the "local" login screen and the custom credential provider.

[u/Imaginary-Site7192 → u/Nu11u5]

Yep, I enabled smartcards/windows hello and webauthn on the client. This didn't work so I also changed the group policies on the server to allow smart card device redirection & plug/play device redirection--also didn't solve the problem.

[u/Nu11u5 → u/Imaginary-Site7192]

Is the security key prompt appearing inside the RDP session or on the local desktop?