Looking for an on-prem MFA solution for Active Directory and RDP

Hi Grey,

If your environment is truly isolated or has limited Internet connectivity, I'd focus on solutions that support on-premises authentication rather than cloud-dependent MFA.

For Windows logon and RDP, products like Duo Authentication for Windows Logon & RDP, RSA SecurID, NetIQ Advanced Authentication, or YubiKey (smart card/FIDO2) are commonly deployed in enterprise environments. The right choice depends on whether your environment is fully air-gapped or has occasional connectivity.

Beyond MFA, I'd also recommend hardening administrative access by:

• Restricting RDP through a Privileged Access Workstation (PAW) or jump server.
• Enforcing Just Enough Administration (JEA) or privileged access controls where appropriate.
• Using Windows LAPS for local administrator password management.
• Enabling auditing and monitoring of privileged logons.

If you're planning for the long term, it's also worth evaluating whether you'll eventually integrate with Microsoft Entra ID for hybrid identity. That can influence which MFA platform makes the most sense today.

One question: Is your environment completely air-gapped, or does it have controlled outbound connectivity? That distinction will narrow the list of viable MFA solutions considerably.