Overview

The Windows Workstation MFA Agent adds multi-factor and passwordless authentication to the Windows login experience, controlled centrally from AdminX Portal.

What is Windows Workstation MFA Agent?

The 1Kosmos Windows Workstation MFA Agent is a Windows Credential Provider that adds multi-factor and passwordless authentication to the Windows login experience. Once installed on a workstation or server, it intercepts the standard Windows sign-in flow and requires users to verify their identity through a second, or sole, authentication factor before access is granted.

The agent integrates with your organisation's Active Directory through the 1Kosmos platform and is managed centrally from the AdminX administration portal. Authentication policies can be scoped to specific users, AD groups, or individual machines, giving administrators precise control over who authenticates how and where.

The agent supports both MFA (password plus an additional factor) and passwordless (no password required) authentication modes, depending on the journey configured in AdminX.

How it Works

The agent operates as a custom Windows Credential Provider. When a user signs in, at the physical console, over Remote Desktop (RDP), or via a Run As / CredUI prompt, the agent presents the 1Kosmos authentication interface alongside or in place of the standard Windows password prompt.

Authentication can be initiated from two entry points on the Windows login screen:

User tile the agent presents the configured authentication factors directly, without requiring the user to type their username first.
Other User tile the agent prompts for a username first, then presents the authentication factors.

Once the user completes the configured authentication journey, the agent passes the validated credential to Windows and the session begins.

The table below covers every login scenario the agent supports and the authentication modes available for each.

Scenario

MFA with Password

Passwordless

Workstation login

✅

Workstation unlock (after screen lock)

✅

Remote Desktop (RDP) — incoming

✅

Remote Desktop (RDP) — outgoing via host machine

✅

Run As / CredUI (UAC elevation)

✅

Shared account login (via CyberArk PAM)

✅

Offline login (no internet / platform unreachable)

✅

Local account login (break-glass)

✅

❌

Supported Authentication Methods

Which methods appear at login depends on the adaptive authentication journey configured for the user in AdminX.

Method

Requires Mobile App

Works Offline

Password

❌

✅

Push Notification

✅

❌

TOTP (1Kosmos App)

✅

❌

QR Code

✅

❌

LiveID

❌

FIDO / 1Key (single-user or multi-user key)

❌

SMS OTP

❌

Email OTP

❌

Voice OTP

❌

Behavior Auth + PIN

❌

✅ (cached PIN)

Offline Account OTP

✅

Note: SMS, Email, and Voice OTP require the user's phone number or email address to be present on their Active Directory profile.

What's Not Covered

The Windows Workstation MFA Agent does not apply 1Kosmos authentication to the following scenarios. These remain controlled by Windows native authentication only.

Pre-boot / BitLocker unlock — The agent operates after BitLocker unlocks the drive. It does not replace or integrate with BitLocker pre-boot authentication.
Non-interactive logon types — Log on as a Service, Log on as Batch Job, Scheduled Tasks, and network drive mappings are not intercepted by the agent.
PowerShell remoting — Enter-PSSession and Invoke-Command are not covered.
RDP Restricted Admin Mode — The agent does not intercept Restricted Admin Mode RDP sessions.
Third-party credential providers — The agent coexists with other credential providers (e.g., Windows Hello, smart card) but does not manage or replace them. Interaction with third-party disk encryption (e.g., Trellix Drive Encryption) may require additional registry configuration, see FAQs.

What's New

The table below summarises significant changes across recent releases. For the full version history including bug fixes, see Release Notes.

Version	Released	Key Changes
2.4.6.0	July 2026	MFA for local Windows accounts (password + MFA via CaaS); OTP & push rate limiting on Windows CP; offline PIN/OTP fixes and corrected login event reporting
2.4.5.0	June 2026	Full session lifecycle tracking (offline-queued); forced Behavioral Auth after offline PIN login; offline PIN logins in audit trail; security fixes
2.4.4.0	May 2026	Behavioral Auth enrollment enforcement (Skip option removed, community-level config); TPM-accelerated smart card login (~20s → 9–11s with auto fallback and cert renewal); multi-language CP UI & Behavioral Auth phrases (Spanish, Portuguese, French, German, OS auto-detect); case-insensitive offline PIN username resolution (incl. "Other User" tile winuserattribute mapping)
2.4.3.0
2.4.2.0		Faster LiveID login (upfront camera init, preloaded pipeline, DSHOW fallback); security fixes
2.4.0.0	March 2026	1Kosmos rebranding (BlockID references removed); MSI auto-dependency check; LiveID early camera warm-up for faster biometric login
2.3.0.0	March 2026	MSI package installation support introduced recommended installer for all new deployments
2.2.0.0	March 2026	Fallback authentication via helpdesk passcode; offline PIN authentication (no mobile app required)
2.1.5.x	Nov 2025 – Feb 2026	Password-based shared account access; command-line installer parameters; dynamic CP disable via registry; PIN lockout notifications
2.1.4.0	Nov 2025	FIDO debug logs (`1KosmosFIDOLogs.txt`); security hardening
2.1.3.0	Oct 2025	Granular password provider filtering (Login vs. CredUI); last-used provider clearing
2.1.2.0	Sep 2025	Behavior Auth + PIN (typing biometrics) introduced

PreviousGetting started with passwordless authentication

NextSystem Requirements

Last updated 28 days ago

Was this helpful?