Yubico Login for Windows supports local authentication scenarios: it secures the local login process for local accounts on Windows computers. Use it to configure login with a YubiKey to a local account on an up-to-date system running Windows 8. This other software can bypass the second factor because it does not integrate with the Windows authentication system. It is possible, however, to install and configure Yubico Login for Windows for a local account on a single instance of Windows that also has these yubikey windows 10 domain login free download types of accounts.
Yubico Login for Windows just has no effect on them. Yubico Login for Windows adds another method of user verification, which exists in parallel with all the other login options enabled for the account. Therefore, if you implement file sharing on your local network, authentication to those resources continues to function normally without second factor authentication.
This guide provides instructions for configuring YubiKeys to work with Yubico Login for Windows; best practices for implementing Yubico Login for Windows, such as configuring a primary and a backup YubiKey for yubikey windows 10 domain login free download account; managing recovery codes; guidance on avoiding common problems; and a comprehensive description of how the end-user interacts with the system after YubiKeys have been implemented.
It is assumed that those who install and configure Yubico Login for Windows are yubikey windows 10 domain login free download with managing Windows computers. This user guide is written for both:. Refer to the User Experience section at the end of this document for a description of what end-users can expect after their accounts have been configured to require YubiKeys.
Only accounts that are supported can be configured for Yubico Login for Windows. If you launch the configuration wizard, and the account you are looking for is not displayed, it is not supported and therefore not available for configuration. You can use an existing CR credential that was programmed for other purposes such as another Windows account or a password manager.
Please note that if the Challenge-Response credential has touch required, you or the end-user will need to tap the touch sensor twice during registration and yubikey windows 10 domain login free download login.
Yubico Login for Windows writes the challenge-response secret to slot 2 by default, but you can have it written to slot 1. The application will warn you before you overwrite anything; however, it will not block you from doing so. Use a different YubiKey for each registration. If you are configuring backup keys, each user should have one YubiKey for the primary and a second one for the backup key. A recovery code is yubikey windows 10 domain login free download last-resort mechanism to authenticate a user if all YubiKeys have been lost.
Recovery codes can be assigned to the users you specify; however, the recovery code is only usable if the username and password for the account are also available. The option to generate a recovery code is presented during the configuration process. The provisioning process has defaults and you only need to specify which accounts you want to enable for use with YubiKeys.
The provisioning flow first lists the local accounts available for selection, then displays a page for each user selected in turn, allowing you to register yubikey windows 10 domain login free download key or keys for each account.
The provisioning operation can be run as often as necessary. When you insert a YubiKey, Yubico Login for Windows will automatically detect it and proceed to the Device Confirmation page for each user. You can add additional YubiKeys for users already configured by selecting the users here. When setting the parameters for the provisioning flow as described in Specify Configuration above, you can determine whether recovery codes can be created for the YubiKey users.
The recovery code is a long string. To eliminate problems caused by the end-user mistaking the numeral 1 for lowercase letter L and 0 for the letter O, the recovery code is encoded in Base32, which treats alphanumeric characters that look similar as if they actually were the same. If this parameter is set, the Recovery Code page is displayed after all the YubiKeys for the specified user account have been configured.
When the local user account has been configured to require a YubiKey, the user is authenticated by the Yubico Credential Provider instead of the default Windows Credential Provider. The user is prompted to insert their YubiKey. Then the Yubico Login screen is presented.
The user enters their username and password. Note : It is not necessary to press the button on the YubiKey to log in. In some instances, pressing the button actually causes the login to fail. If the end-user enters their username and password without inserting the correct YubiKey, authentication will fail and the user will be presented with an error message such as the one shown in the following screenshot:.
The end-user unlocks their computer with their username, recovery code, and password, as shown in the screenshot below:. Until a new YubiKey is configured, the end-user must enter the recovery code each time they log in. Yubico Login for Windows secures the local login process for local accounts on Windows computers. Alternative sign-in methods supported by Windows will not be affected.
If Yubico Login for Windows does not detect that a YubiKey has been inserted, it is likely due to the key not having OTP mode enabled, or you are not inserting a YubiKey, but instead a Security Key, which yubikey windows 10 domain login free download not compatible with this application. What can we help you with?
Yubico Business Guides. Audience It is assumed that those who install and configure Yubico Login for Windows are comfortable with managing Windows computers. This user guide is written for both: An individual user installing Yubico Login for Windows to configure their own account for login with YubiKeys An administrator such as an IT professional installing Yubico Login for Windows to configure login with YubiKeys for a group of end-users.
Requirements For each user both admins and end-users at least one, and preferably two of any of the YubiKeys yubikey windows 10 domain login free download in the Applicable Products section yubikey windows 10 domain login free download. Systems that are running any of the following operating systems, fully updated and for as long as they are supported by Microsoft : Windows 8.
Yubico Login for Windows adds another method of user verification, which exists in parallel with all sign-in options offered natively. Yubico Login for Windows only adds the second factor to local accounts. Before configuration, consider the end-user experience: if you use an existing Challenge-Response with "require touch" enabled, the yubikey windows 10 domain login free download must tap the contact twice during registration and at every login.
Have a plan in place in case end-users lose their YubiKeys, to enable them to regain access to their accounts: Configure at minimum a primary and a backup YubiKey for each end-user. If a user loses both YubiKeys, a new YubiKey yubikey windows 10 domain login free download be added by a local administrator account.
Without a local administrator account, if both YubiKeys are lost the only way of recovering the account is to use a recovery code. Configure a recovery code for each account. Ensure that the username and password for each account are available and have been tested for validity before using Yubico Login for Windows to configure those accounts.
In your provisioning plan, be aware that the only way to remove the YubiKey with Yubico Login for Windows is to remove it from the registry manually. Before Installation Before installing the Yubico Login for Windows software, make a note of your Windows username and password for the local account. The person who installs the software must have the Windows username and password for their account. Without these, nothing can be configured and the account is inaccessible.
The default behavior of the Windows credential provider is to remember your last login so you do not have to actually type in the username. For this reason, many people may not remember the username. However, once you install the tool and reboot, the new Yubico credential provider is loaded, so that both admins and end-users have to actually type in the username.
Windows' automatic login is not compatible with Yubico Login for Windows. If a user whose account was set up for automatic login no longer remembers their original password when the Yubico Login for Windows configuration takes effect, the account can no longer be accessed.
Address this issue preemptively by: Having users set new passwords before disabling automatic login. Have all users verify they can access their accounts with username and their new password before you use Yubico Login for Windows to configure their accounts.
You can use credentials that were programmed for other purposes see step 4 in Specify Configuration below. You can use the same key on multiple accounts on the same system. You can use the same key on accounts on multiple different systems, for example, if you are the admin for a small company, you might want to register your YubiKey on all user accounts to be the backup option for every yubikey windows 10 domain login free download.
Installation Note: Administrator permissions are required to install the software. Verify your username. Once you have installed Yubico Login for Windows and rebooted, you will need to enter this in addition to your password in order to log in. Download the Yubico Login for Windows software from here. Run the installer by double-clicking on the download. Accept the end-user license agreement.
In the installation wizard, specify the destination folder location or accept the default location. Restart the machine on which the software has been installed. After the yubikey windows 10 domain login free download, the Yubico credential provider presents the login screen that prompts for the YubiKey. The Yubico credential provider Yubico Login requires that you enter not only the password for your local Windows account, but also the username, which should have been noted in step 1.
If necessary, consult Microsoft's instructions for switching to the local account. The item actually labelled Yubico Login for Windows is just the installer, not the application. Finding and Selecting "Login Configuration" Configuration Process Note : Administrator permissions are required to configure the software.
Recovery Code A recovery code is a last-resort mechanism to authenticate a user if all YubiKeys have been lost. Specify Configuration The provisioning process has defaults and you only need to specify which accounts you want to enable for use with YubiKeys. The User Account Control dialog appears. If you are running this from a non-Administrator account you will be prompted for local administrator credentials. Yubico Login for Windows Configuration - Defaults The configurable items are: Slots : Select the slot where the challenge-response secret will be stored.
All YubiKeys that have not been customized come pre-loaded with a credential in slot 1, so if you are using Yubico Login for Windows to configure YubiKeys that are already being used for logging into other accounts, do not overwrite slot 1.
If the device yubikey windows 10 domain login free download no existing secret, the provisioning process will generate a new secret. Generate new, random secret, even if a secret is currently configured : A new secret will be generated and programmed to the slot, overwriting any previously configured secret.
Manually input secret: For advanced users : During the provisioning process, the application will prompt you to input manually an HMAC-SHA1 secret 20 bytes - 40 characters hex-encoded. Generate Recovery Code : For each user provisioned, a new recovery code will be generated. This recovery code enables the end-user to log in to the system if they have lost their YubiKey.
For more information, refer to the description of the Recovery Code above. Note : If you select to save a recovery code while provisioning a user for a second key, any previous recovery code becomes invalid, and only the new recovery code will work.
If you do not want to provide recovery codes to your users, it is good practice to give each user a backup YubiKey. For more information, refer to the Primary and Backup Keys section above.
