MFA for onprem domain controllers

Question

Is it possible to have MFA integrated to onpremise AD?
Like when they login using the domain admin account they will go through MFA.

Answer 1

Azure MFA doesn't support MFA for local logon on devices. You should rather focus on hardening your environment and implementing secure administrative hosts for example

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-secure-administrative-hosts

Answer 2

Guys,

I think today a solution is technically possible using FIDO2 keys and the old domain "SCRIL" feature.
Also Remote Credential Guard and Protected Users are components required.

Here all the details :

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/removing-onprem-domain-admins-passwords-with-azure-passwordless/m-p/2803878

Please test yourself reporting feedbacks :) (I only tested in my lab , never in production so a running test might be appreciated ..)

Answer 3

Hi,
As of July 1, 2019, Microsoft no longer offers MFA Server for new deployments.
New customers that want to require multi-factor authentication (MFA) during sign-in events should use cloud-based Azure AD Multi-Factor Authentication.
For more information , you can refer to the following link:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-nps-rdg
https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa

Best Regards,

Answer 4

Thanks for your answers guys. I'm sorry If I can mark only one as Answer.

By the way, to help others who are also needing this, we are going to test Okta's service to apply MFA for on-prem DCs.

Answer 5

Hi. You can enable granular MFA on any/all on-premise AD users with a third party solution UserLock.

More information here: [https://www.isdecisions.com/products/userlock/multi-factor-authentication-mfa-active-directory.htm