> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios.md).

# Deployment Scenarios

***

### Overview

The 1Kosmos Credential Provider is installed on workstations and servers. Once installed, it intercepts Windows authentication events, login, unlock, Run As, UAC, and RDP, and enforces MFA according to the Adaptive Auth Journey assigned to the user.

The behaviour of the agent varies depending on the environment it is deployed in. The pages in this section document each supported deployment scenario, its prerequisites, and any configuration specific to that environment.

### Deployment Scenarios

| Scenario                                                                                                                                   | Description                                                                                                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- |
| [Standard Domain-Joined Workstations](/authentication/windows-workstation-mfa/deployment-scenarios/standard-domain-joined-workstations.md) | The baseline deployment - Active Directory domain-joined machines with full network connectivity to the 1Kosmos tenant                 |
| [RDP / Remote Desktop](/authentication/windows-workstation-mfa/deployment-scenarios/rdp.md)                                                | Incoming and outgoing RDP sessions, covering both configurations where the agent is installed on the remote server and where it is not |
| [Shared Workstations / CyberArk PAM](/authentication/windows-workstation-mfa/deployment-scenarios/shared-workstations.md)                  | Shared device environments using CyberArk Privileged Access Management for shared account authentication via 1Key                      |
| [Offline / Disconnected Environments](/authentication/windows-workstation-mfa/deployment-scenarios/offline-scenario.md)                    | Workstations that operate without network connectivity, using cached credentials for authentication                                    |
| Local Accounts / Break-Glass                                                                                                               | Configuration for local (non-domain) accounts and emergency break-glass access when MFA cannot be completed                            |
| [Entra ID Joined Machines](/authentication/windows-workstation-mfa/deployment-scenarios/entra-joined-workstations.md)                      | Support for Microsoft Entra ID joined machines - currently on the product roadmap                                                      |

***

### General Prerequisites

The following prerequisites apply across all deployment scenarios unless explicitly noted otherwise on a scenario-specific page.

| Prerequisite           | Requirement                                                                               |
| ---------------------- | ----------------------------------------------------------------------------------------- |
| Operating system       | Windows 10 (1903+), Windows 11, Windows Server 2016, 2019, 2022                           |
| Agent version          | See individual scenario pages for version-specific requirements                           |
| Installation directory | `C:\Program Files\1Kosmos\BlockIDCredentialProvider`                                      |
| Log directory          | `C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs`                                 |
| Network connectivity   | Required for all online authentication methods                                            |
| AdminX access          | Administrator access to the 1Kosmos AdminX portal for journey configuration               |
| Active Directory       | Required for domain-joined scenarios; local account scenarios operate independently of AD |

{% hint style="info" %}
Installation and system prerequisites are covered in detail in [Installation.](/authentication/windows-workstation-mfa/installation.md) This section assumes the agent is already installed and the base configuration is complete.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.