> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/standard-domain-joined-workstations.md).

# Standard Domain Joined Workstations

***

### Overview

Standard domain-joined workstations represent the most common deployment of the 1Kosmos Credential Provider. In this scenario:

* The workstation is joined to an Active Directory domain.
* The Credential Provider is installed on the workstation.
* The workstation has network connectivity to the 1Kosmos tenant at all times during authentication.
* Users authenticate using their AD credentials combined with an MFA method defined in an Adaptive Auth Journey.

All authentication methods documented in the [Authentication Methods ](/authentication/windows-workstation-mfa/authentication-methods.md)section are supported in this scenario.

### Admin Setup

#### Prerequisites

| Requirement                 | Detail                                                                      |
| --------------------------- | --------------------------------------------------------------------------- |
| Domain membership           | Machine must be joined to an Active Directory domain                        |
| Agent installed             | Credential Provider installed on each target workstation                    |
| User accounts               | Users must have accounts in Active Directory                                |
| 1Kosmos tenant connectivity | Workstation must be able to reach the 1Kosmos tenant over HTTPS (port 443)  |
| User enrollment             | Users must be enrolled in the 1Kosmos platform with at least one MFA method |

#### Configure the Authentication Journey

1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
2. Create a new journey or edit an existing one.
3. Select the desired authentication method (see [Authentication Methods ](/authentication/windows-workstation-mfa/authentication-methods.md)for all available options).
4. Under **Assignment**, assign the journey to the target user group, organisational unit, or machine policy as appropriate for your environment.
5. Save and publish the journey.

#### Group Policy Deployment (Recommended)

For environments with multiple workstations, deploy the Credential Provider via Group Policy Object (GPO) to ensure consistent installation and configuration across all target machines.

1. Place the installer package in a network share accessible to all target machines.
2. Create a new GPO and link it to the target OU.
3. Under **Computer Configuration > Software Settings > Software Installation**, add the MSI package.
4. Configure the `REGCONFIG.ini` settings file with your tenant URL, tenant ID, and policy settings before deployment.
5. Apply the GPO and verify installation on a test machine before broad rollout.

{% hint style="info" %}
See [Installation](/authentication/windows-workstation-mfa/installation/install-using-msi.md) for full MSI deployment parameters and `REGCONFIG.ini` configuration reference.
{% endhint %}

#### Verify Connectivity

After installation, confirm the workstation can reach the 1Kosmos tenant before expecting users to authenticate.

1. On the workstation, open a browser and navigate to your 1Kosmos tenant URL.
2. Confirm the page loads without SSL or connection errors.
3. Review the Credential Provider logs at `C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs` for any connectivity errors on the first login attempt.

#### User Guide

#### Login

1. At the Windows login screen, click the **1Kosmos** tile.
2. If using the **Other User** tile, enter your domain username (in `DOMAIN\username` or `username@domain` format) first.
3. Complete the authentication steps required by your assigned journey.
4. The Windows session unlocks and you are logged in.

#### Unlock

The same authentication flow applies when unlocking a locked workstation. Press any key or move the mouse to wake the screen, then click the **1Kosmos** tile and complete your assigned MFA method.

{% hint style="info" %}
If a user's journey requires push notification or QR code, the mobile device must be available at the time of unlock. For environments where users frequently step away from their desks without their phones, consider enabling [Offline / Disconnected Environments ](/authentication/windows-workstation-mfa/deployment-scenarios/offline-scenario.md)support with cached PIN as a fallback.
{% endhint %}

#### Troubleshooting

| Issue                                                  | Likely Cause                                                           | Resolution                                                                                                                                                     |
| ------------------------------------------------------ | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1Kosmos tile not visible on login screen               | Agent not installed correctly; Credential Provider service not running | Verify installation in `C:\Program Files\1Kosmos\BlockIDCredentialProvider`; check Windows Services for the 1Kosmos service; re-run the installer if necessary |
| Authentication fails with "User not found"             | User's AD account not synced to the 1Kosmos tenant; UPN mismatch       | Verify the user exists in AdminX under **Users > All Users**; confirm the UPN format matches between AD and the 1Kosmos tenant                                 |
| Authentication fails consistently for all users        | Tenant connectivity lost; certificate issue                            | Check network connectivity from the workstation to the tenant URL; review logs at `C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs` for error details  |
| User not prompted for MFA — logs in with password only | No journey assigned to the user or machine                             | Verify the user is included in the assignment scope of a published Adaptive Auth Journey in AdminX                                                             |
| Login screen reverts to standard Windows provider      | Credential Provider service crashed                                    | Restart the 1Kosmos Credential Provider service; review logs for crash details; contact 1Kosmos support if recurring                                           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/standard-domain-joined-workstations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.