Looking for an on-prem MFA solution for Active Directory and RDP

This is something I've been testing as well. I've recently set up Protectimus in a small proof-of-concept environment, and so far the experience has been very positive. The deployment was fairly straightforward, and it didn't take much time to get everything working.

At a high level, the setup involved:

Creating a Protectimus account and configuring the basic settings.
Adding users and assigning authentication methods.
Integrating Protectimus with the target service that required MFA.
Testing the login process with enrolled users.
Adjusting authentication policies where needed.
Rolling the configuration out to additional users after successful testing.

I'm still in the early stages of testing, so I haven't deployed it across the whole environment yet. At the moment only a small number of users are using it, but everything has been working reliably so far. If anyone has experience with larger deployments, I'd be interested to hear how it went.

This is something we have been looking at as well. I've successfully implemented YubiKey smart card in a proof of concept and it has been working well so far. You can learn more about it here: YubiKey smart card deployment guide

At a high level, the steps required to deploy are:

• Install the YubiKey minidriver on every server, as well as every workstation used for RDP
• Create and deploy a GPO to configure what happens when the YubiKey is removed (should the user be logged off or the desktop locked?), and allow ECC certificates to be used for logon and authentication
• Optionally configure a PIN Unlock Key (PUK) on each YubiKey deployed
• Create and deploy the certificate template to be enrolled, either with self-enrollment or for enrolling on behalf of each admin
• Once each admin is enrolled, enable the "Smart card is required for interactive log on" setting on their account

It has been working well so far but we are still very early in our PoC. (I am currently the only user testing at the moment, I have only deployed the minidriver on a handful of servers and am not yet enforcing smart card logon) so take that for what it's worth. Let me know if you'd like any further details.

Hi Grey,

If your environment is truly isolated or has limited Internet connectivity, I'd focus on solutions that support on-premises authentication rather than cloud-dependent MFA.

For Windows logon and RDP, products like Duo Authentication for Windows Logon & RDP, RSA SecurID, NetIQ Advanced Authentication, or YubiKey (smart card/FIDO2) are commonly deployed in enterprise environments. The right choice depends on whether your environment is fully air-gapped or has occasional connectivity.

Beyond MFA, I'd also recommend hardening administrative access by:

• Restricting RDP through a Privileged Access Workstation (PAW) or jump server.
• Enforcing Just Enough Administration (JEA) or privileged access controls where appropriate.
• Using Windows LAPS for local administrator password management.
• Enabling auditing and monitoring of privileged logons.

If you're planning for the long term, it's also worth evaluating whether you'll eventually integrate with Microsoft Entra ID for hybrid identity. That can influence which MFA platform makes the most sense today.

One question: Is your environment completely air-gapped, or does it have controlled outbound connectivity? That distinction will narrow the list of viable MFA solutions considerably.