Windows 10: Recommendations on isolated multifactor authentication solution

Sorry for the unclear title (and I wasn't sure if this is the proper forum), but I am looking for recommendations on multifactor authentication solutions for Windows 10 Professional 1709 boxes that are disconnected from the Internet. In a test environment, we're being required to add some flavor of multi-factor authentication to a system that is not domain-joined, is not connected to anything other than a router and a few RHEL servers, and is in no way connected to the Internet.

To complicate things, biometrics, including facial and fingerprint, are likely not going to be an approved solution. We already have PIV (CACs) smartcards in this environment, so being able to implement those would be great. IT would be great if the solution could extend to other hardware devices, such as the Cisco network gear, but that's not as important right now.

:)

 

Multi-factor authentication on Windows 10

You can use the multifactor authentication server, running on the same ADFS server, if the server has some computing power to spare for that new service. There are also lots of third party tools you can use to be able to do multifactor authentication.
Like physical tokens. Hope that helps you out on your quest to getting the multifactor authentication knowledge.

 

Windows 10 "Email security" setting not available for any accounts.

Having several email accounts in Win10 mail is convenient, way too convenient. I have lost multifactor authentication which I require. Unless there is a solution to use multifactor authentication within Win10 Mail, I will delete my email accounts from Microsoft
Outlook, and revert to more secure (and less convenient) html multifactor logins.

 

May I ask why a fingerprint reader on the system will not be allowed? That would be best for securing the offline PC. Plus, they aren't that expensive.

You could look at using a local software tool and then using a USB hardware key. Or even something like a pre-bios encryption key that would lock the PC.

How many PCs are we talking about here? Is there a limited budget?

 

Smart Card or some kind of access token device (like the RSA SecureID) should do the trick and comply with that policy.
HTH,
--Ed--

How Smart Card Sign-in Works in Windows (Windows 10)
RSA SecurID Access