0
Windows desktop releases: 8, 8.1, 10 and 11
Windows · Multi Factor Authentication
Windows Login Multi Factor Authentication
Spriv's patented Credential Provider adds a second factor to the Windows login screen itself, on desktops, on Windows Server and in Remote Desktop sessions. Once a user is paired, the phone confirms the login in the background, so most sign-ins look exactly like they do today.
Windows login · Second factor on the paired phone
0
Windows Server releases: 2012 R2 to 2022
0 ms
Typical time to clear the second factor
0 min
Install time, start to finish
Coverage
What Windows login MFA protects
One installer covers every way a person signs in to a Windows machine, whether they are sitting at it or connecting remotely.
Windows desktops
Local account logins on Windows 8, 8.1, 10 and 11, for laptops and workstations that hold sensitive data.
Windows Server
Windows Server 2012 R2, 2016, 2019 and 2022, so a stolen admin password no longer opens a server.
Remote Desktop sessions
RDP logins to any of those machines get the same check. Adaptive MFA for RDP.
iOS and Android
The Spriv app handles pairing, push approvals and TOTP codes on the phone your users already carry.
At the login screen
How Windows login MFA works
STEP 01
The user signs in as usual
Username and password go in exactly as before. The Credential Provider then runs the second factor before the desktop loads.
STEP 02
Spriv scores the attempt
The risk engine weighs location, device reputation, login history, behavior patterns, time of access and network characteristics.
STEP 03
Approve, deny or escalate
A trusted computer-and-phone pair clears silently. Anything unusual is escalated to the phone, where the user can approve or deny with one tap.
Private by design. Adaptive authentication only confirms that the phone and the computer are in the same place. Spriv never shares the phone's actual location.
Login options
Second factor choices on the Windows login screen
Adaptive authentication is the default. Users can switch to another option at the login prompt when they need to.
Adaptive authentication, the default
Spriv checks that the phone's location matches the computer's. A match approves automatically; a mismatch lets the user approve or deny manually. It needs the paired Spriv app and a working internet connection on the phone.
Allow / Deny push
A push notification on every login showing the username, IP address and server name, so the user can tell a real attempt from an attack before tapping.
Two-way SMS
An SMS to the user's phone, answered with "Yes" or "No". No app needed and it works in over 200 countries. Two-way SMS is billed per message.
TOTP code
A six-digit code from the Spriv app with a 30-second lifetime. It needs no internet or carrier signal, which makes it the fallback while travelling.
Deployment
Installing MFA on Windows and Windows Server
The installer runs on the machine you want to protect. Pair the users first, so nobody is locked out the moment it goes live.
1. Pair the users
Every user who logs on to the machine must exist in Spriv and have a paired phone before you install.
2. Download x86 or x64
In the Spriv Control Panel, open Applications and download the installer that matches the Windows architecture.
3. Name the service
Set the Service Name users see while connecting and the Login Text shown in the phone app.
4. Add API credentials
Paste the API Key and API Secret from the Control Panel's Service Account section, then click Install.
Step-by-step guide. Screens, settings and the uninstall procedure are in the Windows RDP install guide.
Questions
Windows login MFA questions
Which versions of Windows are supported?
Windows 8, 8.1, 10 and 11 for local accounts, and Windows Server 2012 R2, 2016, 2019 and 2022, including Remote Desktop logins to any of them.
Can users still log in if the internet is down?
Yes. With the computer offline, a user enters their local username and password and, if one was set during install, a Bypass Code. Logging in offline.
Can I block a user straight away?
Yes. Each user has a status in the admin control panel: Active, Deny, Bypass or Locked, and an administrator can change it at any time.
What if an administrator loses their phone?
Save the Recovery Code when you set up your account and keep at least two administrator accounts, each paired with a different phone. Account recovery options.
How do I remove Windows login MFA?
Uninstall "Spriv Credential Provider for Windows" from Control Panel, or boot into Safe Mode and run UnregisterFilter from the install folder. Removal guide.
How much does it cost?
The Startup plan is free for 2 users and 2 servers, with no credit card. The Business plan is $5.5/month/user with unlimited users, and servers are billed at $10/server/month. See pricing.
Explore
Related pages
Checkit!
Put a second factor on every Windows login
Two free users and two free servers, no credit card. Install in under five minutes on a desktop or a Windows Server.