Standard Domain Joined Workstations

Baseline deployment scenario for 1Kosmos Windows Workstation MFA Agent. Covers Active Directory domain-joined machines with full network connectivity to 1Kosmos tenant.

---

Overview

Standard domain-joined workstations represent the most common deployment of the 1Kosmos Credential Provider. In this scenario:

• The workstation is joined to an Active Directory domain.

• The Credential Provider is installed on the workstation.

• The workstation has network connectivity to the 1Kosmos tenant at all times during authentication.

• Users authenticate using their AD credentials combined with an MFA method defined in an Adaptive Auth Journey.

All authentication methods documented in the Authentication Methods section are supported in this scenario.

Admin Setup

Prerequisites

Requirement	Detail
Domain membership	Machine must be joined to an Active Directory domain
Agent installed	Credential Provider installed on each target workstation
User accounts	Users must have accounts in Active Directory
1Kosmos tenant connectivity	Workstation must be able to reach the 1Kosmos tenant over HTTPS (port 443)
User enrollment	Users must be enrolled in the 1Kosmos platform with at least one MFA method

Configure the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2. Create a new journey or edit an existing one.

3. Select the desired authentication method (see Authentication Methods for all available options).

4. Under Assignment, assign the journey to the target user group, organisational unit, or machine policy as appropriate for your environment.

5. Save and publish the journey.

Group Policy Deployment (Recommended)

For environments with multiple workstations, deploy the Credential Provider via Group Policy Object (GPO) to ensure consistent installation and configuration across all target machines.

1. Place the installer package in a network share accessible to all target machines.

2. Create a new GPO and link it to the target OU.

3. Under Computer Configuration > Software Settings > Software Installation, add the MSI package.

4. Configure the REGCONFIG.ini settings file with your tenant URL, tenant ID, and policy settings before deployment.

5. Apply the GPO and verify installation on a test machine before broad rollout.

See Installation for full MSI deployment parameters and REGCONFIG.ini configuration reference.

Verify Connectivity

After installation, confirm the workstation can reach the 1Kosmos tenant before expecting users to authenticate.

1. On the workstation, open a browser and navigate to your 1Kosmos tenant URL.

2. Confirm the page loads without SSL or connection errors.

3. Review the Credential Provider logs at C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs for any connectivity errors on the first login attempt.

User Guide

Login

1. At the Windows login screen, click the 1Kosmos tile.

2. If using the Other User tile, enter your domain username (in DOMAIN\username or username@domain format) first.

3. Complete the authentication steps required by your assigned journey.

4. The Windows session unlocks and you are logged in.

Unlock

The same authentication flow applies when unlocking a locked workstation. Press any key or move the mouse to wake the screen, then click the 1Kosmos tile and complete your assigned MFA method.

If a user's journey requires push notification or QR code, the mobile device must be available at the time of unlock. For environments where users frequently step away from their desks without their phones, consider enabling Offline / Disconnected Environments support with cached PIN as a fallback.

Troubleshooting

Issue	Likely Cause	Resolution
1Kosmos tile not visible on login screen	Agent not installed correctly; Credential Provider service not running	Verify installation in C:\Program Files\1Kosmos\BlockIDCredentialProvider; check Windows Services for the 1Kosmos service; re-run the installer if necessary
Authentication fails with "User not found"	User's AD account not synced to the 1Kosmos tenant; UPN mismatch	Verify the user exists in AdminX under Users > All Users; confirm the UPN format matches between AD and the 1Kosmos tenant
Authentication fails consistently for all users	Tenant connectivity lost; certificate issue	Check network connectivity from the workstation to the tenant URL; review logs at C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs for error details
User not prompted for MFA — logs in with password only	No journey assigned to the user or machine	Verify the user is included in the assignment scope of a published Adaptive Auth Journey in AdminX
Login screen reverts to standard Windows provider	Credential Provider service crashed	Restart the 1Kosmos Credential Provider service; review logs for crash details; contact 1Kosmos support if recurring