Integrations · Windows Remote Desktop
Windows Remote Desktop 2FA with the Notakey Windows Credential Provider
For IT teams whose servers and workstations are reached over Remote Desktop with nothing but a Windows password. The Notakey Windows Credential Provider adds a phone approval to the login screen, and can make it the only way in.
How it connects
A credential provider on the machine, an application on the appliance
The Notakey Windows Credential Provider (WCP) installs on the Windows machine and appears as a sign-in option on the lock screen. It talks to your Notakey appliance over its API, using a Service ID and API client credentials stored in the registry. When the user picks the Notakey provider, the appliance sends an approval request to their phone with the username and the machine name, and the login completes when they approve.
The first time, the user enters username and password and Notakey asks permission to encrypt the password. From then on the login is username plus phone approval. The users, their Windows accounts and the Remote Desktop setup itself stay as they are; Active Directory can remain the user source, with phones onboarded through Notakey Authenticator.
If Notakey should be the only way in, the default credential provider can be disabled per machine through the registry, or across the fleet through Group Policy. After that, logins need just the username and the second factor.
What to know before you start
- Each Windows machine needs the credential provider installed and the registry values imported. Group Policy offers fleet-scale control for the passwordless-only switch.
- Enable “force biometric check” on the application if every login must also require a fingerprint or face verification on the phone.
- Users synchronised from Active Directory can later get escalation or multi-user approval policies; those policies are not part of the basic setup described in the guide.
- Disabling the default credential provider removes the password-only sign-in. Test on one machine before you apply it across the fleet.
- The registry file contains the API client secret. Treat it as a credential when you distribute it.
From zero to the first approval
- 01
Prepare the application on the appliance
Create an application named Windows Remote Desktop, enable biometric check support, define users directly or connect Active Directory, and set onboarding requirements so the application appears in Notakey Authenticator. Create an API client with an empty scopes field to get the Client ID and secret.
- 02
Import the registry file and install the provider
Write a registry file with your appliance’s API URL, the Service ID and the API credentials, import it, install the newest Windows Credential Provider from the downloads page and restart. The message TTL and the create and wait timeouts have sensible defaults of 30, 20 and 60 seconds.
- 03
Log in once, then approve from the phone
Log in normally once, lock the machine, select the Notakey Credential Provider and enter username and password. Allow Notakey to encrypt the password; every login after that is username plus a tap on the phone.
Frequently asked questions
- Does Remote Desktop 2FA work with Active Directory accounts?
- Yes. Active Directory can stay the user source; phones are onboarded through Notakey Authenticator and the login becomes username plus phone approval.
- Can the phone approval be the only way to log in?
- Yes. Disable the default credential provider per machine through the registry, or across the fleet through Group Policy. After that, logins need just the username and the second factor.
- What has to be installed on each machine?
- The Notakey Windows Credential Provider from the downloads page, plus a registry file with the appliance API URL, the Service ID and the API client credentials. The file contains the API client secret, so treat it as a credential when you distribute it.
Guides and documentation
- Windows Remote Desktop 2FA: phone approval for RDP logins
- Downloads: Windows Credential Provider and appliance
Related products