> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/overview.md).
# Overview
### What is Windows Workstation MFA Agent?
The 1Kosmos Windows Workstation MFA Agent is a Windows Credential Provider that adds multi-factor and passwordless authentication to the Windows login experience. Once installed on a workstation or server, it intercepts the standard Windows sign-in flow and requires users to verify their identity through a second, or sole, authentication factor before access is granted.
The agent integrates with your organisation's Active Directory through the 1Kosmos platform and is managed centrally from the AdminX administration portal. Authentication policies can be scoped to specific users, AD groups, or individual machines, giving administrators precise control over who authenticates how and where.
The agent supports both **MFA** (password plus an additional factor) and **passwordless** (no password required) authentication modes, depending on the journey configured in AdminX.
### How it Works
The agent operates as a custom Windows Credential Provider. When a user signs in, at the physical console, over Remote Desktop (RDP), or via a Run As / CredUI prompt, the agent presents the 1Kosmos authentication interface alongside or in place of the standard Windows password prompt.
Authentication can be initiated from two entry points on the Windows login screen:
* **User tile** the agent presents the configured authentication factors directly, without requiring the user to type their username first.
* **Other User tile** the agent prompts for a username first, then presents the authentication factors.
Once the user completes the configured authentication journey, the agent passes the validated credential to Windows and the session begins.
***
### Supported Login Scenarios
The table below covers every login scenario the agent supports and the authentication modes available for each.
| Scenario | MFA with Password | Passwordless |
| -------------------------------------------------- | :---------------: | :----------: |
| Local console login | ✅ | ✅ |
| Workstation unlock (after screen lock) | ✅ | ✅ |
| Remote Desktop (RDP) — incoming | ✅ | ✅ |
| Remote Desktop (RDP) — outgoing via host machine | ✅ | ✅ |
| Run As / CredUI (UAC elevation) | ✅ | ✅ |
| Shared account login (via CyberArk PAM) | ✅ | ✅ |
| Offline login (no internet / platform unreachable) | ✅ | ✅ |
| Local account login (break-glass) | ✅ (password only) | ❌ |
### Supported Authentication Methods
Which methods appear at login depends on the adaptive authentication journey configured for the user in AdminX.
| Method | Requires Mobile App | Works Offline |
| ------------------------------------------- | :-----------------: | :------------: |
| Password | ❌ | ✅ |
| Push Notification | ✅ | ❌ |
| TOTP (1Kosmos App) | ✅ | ❌ |
| QR Code | ✅ | ❌ |
| FIDO / 1Key (single-user or multi-user key) | ❌ | ❌ |
| SMS OTP | ❌ | ❌ |
| Email OTP | ❌ | ❌ |
| Voice OTP | ❌ | ❌ |
| Behavior Auth + PIN | ❌ | ✅ (cached PIN) |
| Offline Account OTP | ✅ | ✅ |
{% hint style="info" %}
**Note:** SMS, Email, and Voice OTP require the user's phone number or email address to be present on their Active Directory profile.
{% endhint %}
***
### What's Not Covered
The Windows Workstation MFA Agent does **not** apply 1Kosmos authentication to the following scenarios. These remain controlled by Windows native authentication only.
* **Local Windows accounts** — Local accounts bypass MFA and use only the Windows password. This is by design, providing a break-glass option for IT administrators.
* **Pre-boot / BitLocker unlock** — The agent operates after BitLocker unlocks the drive. It does not replace or integrate with BitLocker pre-boot authentication.
* **Non-interactive logon types** — Log on as a Service, Log on as Batch Job, Scheduled Tasks, and network drive mappings are not intercepted by the agent.
* **PowerShell remoting** — `Enter-PSSession` and `Invoke-Command` are not covered.
* **RDP Restricted Admin Mode** — The agent does not intercept Restricted Admin Mode RDP sessions.
* **Third-party credential providers** — The agent coexists with other credential providers (e.g., Windows Hello, smart card) but does not manage or replace them. Interaction with third-party disk encryption (e.g., Trellix Drive Encryption) may require additional registry configuration, see [FAQs](/authentication/windows-workstation-mfa/faqs.md).
***
### What's New
The table below summarises significant changes across recent releases. For the full version history including bug fixes, see [Release Notes.](/authentication/windows-workstation-mfa/release-notes-for-windows-workstation-mfa.md)
| Version | Released | Key Changes |
| ----------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| **2.4.0.0** | March 2026 | 1Kosmos rebranding (BlockID references removed); MSI auto-dependency check; LiveID early camera warm-up for faster biometric login |
| **2.3.0.0** | March 2026 | MSI package installation support introduced recommended installer for all new deployments |
| **2.2.0.0** | March 2026 | Fallback authentication via helpdesk passcode; offline PIN authentication (no mobile app required) |
| **2.1.5.x** | Nov 2025 – Feb 2026 | Password-based shared account access; command-line installer parameters; dynamic CP disable via registry; PIN lockout notifications |
| **2.1.4.0** | Nov 2025 | FIDO debug logs (`1KosmosFIDOLogs.txt`); security hardening |
| **2.1.3.0** | Oct 2025 | Granular password provider filtering (Login vs. CredUI); last-used provider clearing |
| **2.1.2.0** | Sep 2025 | Behavior Auth + PIN (typing biometrics) introduced |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/overview.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.