> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios.md).

# Deployment Scenarios

1Kosmos Credential Provider intercepts Run As and UAC elevation prompts, requiring MFA before elevated access is granted. From v2.0.7.0, passwordless authentication is supported for these scenarios.

***

### Overview

The 1Kosmos Credential Provider is installed on workstations and servers. Once installed, it intercepts Windows authentication events, login, unlock, Run As, UAC, and RDP, and enforces MFA according to the Adaptive Auth Journey assigned to the user.

The behaviour of the agent varies depending on the environment it is deployed in. The pages in this section document each supported deployment scenario, its prerequisites, and any configuration specific to that environment.

### Deployment Scenarios

| Scenario                                                                                                                                   | Description                                                                                                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- |
| [Standard Domain-Joined Workstations](/authentication/windows-workstation-mfa/deployment-scenarios/standard-domain-joined-workstations.md) | The baseline deployment - Active Directory domain-joined machines with full network connectivity to the 1Kosmos tenant                 |
| [RDP / Remote Desktop](/authentication/windows-workstation-mfa/deployment-scenarios/rdp.md)                                                | Incoming and outgoing RDP sessions, covering both configurations where the agent is installed on the remote server and where it is not |
| [Shared Workstations / CyberArk PAM](/authentication/windows-workstation-mfa/deployment-scenarios/shared-workstations.md)                  | Shared device environments using CyberArk Privileged Access Management for shared account authentication via 1Key                      |
| [Offline / Disconnected Environments](/authentication/windows-workstation-mfa/deployment-scenarios/offline-scenario.md)                    | Workstations that operate without network connectivity, using cached credentials for authentication                                    |
| Local Accounts / Break-Glass                                                                                                               | Configuration for local (non-domain) accounts and emergency break-glass access when MFA cannot be completed                            |
| [Entra ID Joined Machines](/authentication/windows-workstation-mfa/deployment-scenarios/entra-joined-workstations.md)                      | Support for Microsoft Entra ID joined machines - currently on the product roadmap                                                      |

***

### General Prerequisites

The following prerequisites apply across all deployment scenarios unless explicitly noted otherwise on a scenario-specific page.

| Prerequisite           | Requirement                                                                               |
| ---------------------- | ----------------------------------------------------------------------------------------- |
| Operating system       | Windows 10 (1903+), Windows 11, Windows Server 2016, 2019, 2022                           |
| Agent version          | See individual scenario pages for version-specific requirements                           |
| Installation directory | `C:\Program Files\1Kosmos\BlockIDCredentialProvider`                                      |
| Log directory          | `C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs`                                 |
| Network connectivity   | Required for all online authentication methods                                            |
| AdminX access          | Administrator access to the 1Kosmos AdminX portal for journey configuration               |
| Active Directory       | Required for domain-joined scenarios; local account scenarios operate independently of AD |

{% hint style="info" %}
Installation and system prerequisites are covered in detail in [Installation.](/authentication/windows-workstation-mfa/installation.md) This section assumes the agent is already installed and the base configuration is complete.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.