Скачать или смотреть How to add Multi-Factor Authentication for Windows Active Directory Identities

Watch how UserLock 11.1 (https://www.isdecisions.com/products/...) enables MFA for Windows Logon, RDP, RD Gateway, VPN, IIS & Cloud Apps.

UserLock provides a cost-effective, easy-to-use and scalable solution to protect employees access to the corporate network and cloud applications, both on-site and remote. Deployed easily alongside on-premise Active Directory, UserLock is the go-to access management solution for hybrid AD environments.

Watch
How easy set-up is even for large user bases
How to customize MFA by user and connection types
How to set up recovery codes
How users are on-boarded for mobile apps and hardware tokens
How administrators can easily respond to user help requests
How to extend MFA with Single Sign-On access to Cloud Applications
How MFA is enforced on offline connections
How MFA is enforced on remote connections without domain access

Learn more on how to apply MFA for Remote Desktop Gateway Sessions
https://www.isdecisions.com/products/...
Learn more on how to apply MFA for VPN
https://www.isdecisions.com/products/...
Learn more on how to apply MFA for IIS Apps such as OWA, RDWeb and Sharepoint
https://www.isdecisions.com/products/...
Learn more on how to enroll remote users with MFA
https://www.isdecisions.com/products/...

Video Transcript :
UserLock allows you to implement MFA to your Active Directory logons across all connection types including local and RDP sessions, remote connections through VPN or IIS, and access to cloud applications with Single Sign-On. UserLock works seamlessly alongside your Active Directory without modifying anything to its schema or installing anything on your Domain Controller. This would include RD gateway connections, web applications such as Outlook Web Access and RDweb, VPN connections through RADIUS, and connections to cloud applications via the SSO feature. You can also enable one time use Recovery Codes for users that can be used as another backup MFA method. Here you can choose between 4 and 20 codes per user that can be used ON or Offline. Once you've activated the protected account, the user will need to configure MFA at their next login. The onboarding experience is easy and intuitive with a clear step by step guide. Users will have the option to configure the MFA with an Authenticator App such as Microsoft or Google authenticator, or with a USB token from Yubico or Token2. The admin can choose to allow users to configure one or two methods if they want to provide more options. If choosing the Authenticator App, the next window will instruct them in 3 steps how to download the App, scan the QR code, and enter the OTP code to complete the configuration. If you’ve enabled more than one method, the user will be prompted to add the second method next. Here we have the Recovery Codes that the user can save to a text file to print and to keep safe. The next time the user needs to authenticate with MFA, they will be prompted with this dialog box where they can enter the OTP code from the Authenticator App or insert the USB token and the code will appear automatically. If users are unable to authenticate and need assistance, they can click the "Ask for help" button, and a notification will be sent to the administrator. Back in the UserLock console, you can manage these help requests and decide to either temporarily disable the MFA, reset the MFA key, or mark as resolved. Here you can see all MFA events in real time including successful and failed attempts, when users click on the skip option and also help requests. With the SSO feature, you can also secure access to your cloud resources with MFA to applications such as Microsoft 365 and many more. This allows you to manage all MFA policies from one source and allows users to use Single Sign-On when connecting to cloud applications with their Active Directory account. UserLock MFA does not require any internet connection for logins to network devices, however if users are logging in to these devices while not connected to the corporate network through VPN, you can still enforce MFA. You can manage this in the server properties under logons without network connection. And select "Ask for MFA" for users who are already enrolled, or "Force MFA" or require MFA for enrolled users, and deny access to any connection to the machine who is not enrolled in MFA. Another option for managing remote workers who are not connected to VPN, is to enable UserLock Anywhere. This is a web application that acts as a bridge between the offline machine and the UserLock server. This ensures admins that MFA will always be required, and agents will be updated in real time without requiring the user to connect back to the corporate network.