Last updated
Add two-factor authentication to Remote Desktop and local logons and credentialed UAC elevation prompts.
$ winget install --id DuoSecurity.Duo2FAAuthenticationforWindows --exact --version 5.3.0.2497Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
Duo Authentication for Windows Logon uses EXE. The silent install switches are /quiet /norestart.
duo-win-login-5.3.0.exe /quiet /norestart
See the full silent install reference for Duo Authentication for Windows Logon →
For Intune admins
Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.
Start free 30-day trialNo credit card required.
Duo Authentication for Windows Logon adds Duo two-factor authentication to these Windows and Windows Server logon scenarios:
- Local or domain account logins
- Logins at the local console and/or incoming Remote Desktop (RDP) connections
- Credentialed User Access Control (UAC) elevation requests (e.g. Right-click + "Run as administrator") in v4.1.0 and later
Duo's Windows Logon client does not add a secondary authentication prompt to the following logon types:
- Shift + right-click "Run as different user"
- PowerShell "Enter-PSSession" or "Invoke-Command" cmdlets
- Non-interactive logons (i.e. Log on as a Service, Log on as Batch, Scheduled Tasks, drive mappings, etc.)
- Pre-Logon Access Providers (PLAPs) such as Windows Always On VPN
- RDP Restricted Admin Mode
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
4 known CVEs via NVD
A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. This vulnerability is due to a failure to invalidate locally created trusted sessio...
A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of an unencrypted regi...
A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected mac...
The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows...
See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr.