RDP MFA for Windows Server
Every Remote Desktop sign-in waits for a tap on the U2 Secured Authenticator app after the password, with a number to match. If the server cannot reach U2 Secured, a code from the same app gets the user in.
One MSI on each server, with no gateway or NPS server to run. It protects local Windows accounts and has been run end to end on Windows Server 2025.
What a Remote Desktop sign-in looks like
A number to match on the remote screen
Once Windows has the password, the remote screen goes straight to a number, and the phone shows three under “Remote Desktop sign-in as alice on reception-pc”. The user taps the one that matches.
Denied means no session
A wrong number or a Deny refuses the sign-in, and the connection stays at the sign-in screen until it is closed. No session is opened.
On the server, not in front of it
The check runs at the Windows sign-in on the machine itself, so there is no gateway to deploy. The same approval also guards the server’s console sign-in and unlock.
Codes when the server is cut off
If the server cannot reach U2 Secured, or the phone does not answer, the tile asks for a code from the app or a one-time backup code, checked on the server itself.
A log of who signed in where
Each server appears in the developer portal with its sign-ins, marked as Remote Desktop, including the offline ones it reports when it is back online.
Roll out one person at a time
Only members of the local “U2 Secured Users” group are asked for U2, and an emergency administrator kept outside the group keeps a password-only way in.
Compared with Microsoft’s RD Gateway route
Microsoft’s documented way to add MFA to Remote Desktop Services puts it at RD Gateway, through an NPS server. If your people have local Windows accounts on the servers they reach, U2 Secured needs none of that. Every Microsoft entry is read from Microsoft’s own documentation; the link on each row goes to it, dated the day it was read.
Add MFA to RDP in four steps
The full guide, with every MSI property and how to verify each sign-in, is in the developer docs.
- 1
Create an app for your servers
In the developer portal: one app for the fleet, named after it, because that name is what users see on every approval. Create a registration token on its Machines tab.
- 2
Install the MSI on each server
Download it from https://u2secured.com/downloads/windows/u2secured-windows-0.2.0-x64.msi and check its SHA-256 against https://u2secured.com/downloads/windows/SHA256SUMS. Run it silently from an elevated prompt or your deployment tool; the server registers during the install, and nobody is asked for U2 yet.
msiexec /i u2secured-windows-0.2.0-x64.msi /qn REGISTRATION_TOKEN=rkr_… MACHINE_NAME=<name> - 3
Enrol each person
u2auth-admin enroll links a local account to the app and sets up their offline codes. Each person pairs their phone with the U2 Secured Authenticator once.
- 4
Add them to the group, then test over RDP
Put each enrolled person in “U2 Secured Users”; to sign in remotely they also need to be in Windows’ “Remote Desktop Users” group, as always. Test the first person over Remote Desktop while the emergency administrator is still signed in, then add everyone else.
What RDP MFA costs
The free Developer plan is enough to try it on a few servers: 100 push approvals a month, and codes from the app are never metered.
| Plan | Price | Includes |
|---|---|---|
| Developer | Free | 1,000 active users and 100 push approvals a month, 1 app. Codes are unlimited. |
| Growth | $99/month | 25,000 active users and 100,000 push approvals a month, 5 apps. Codes are unlimited. |
| Team | $149/month | 75,000 active users and 300,000 push approvals a month, 20 apps. Codes are unlimited. |
| Scale | $199/month | 250,000 active users and 1,000,000 push approvals a month, unlimited apps. Codes are unlimited. |
One flat monthly price per developer account, not a price per user or per machine. A fleet of servers is one app; each person who signs in counts once a month however many machines they use. Codes from the app (TOTP) and backup codes are never metered on any plan.
Questions administrators ask
- Does RDP support MFA on its own?
- Remote Desktop signs you in with your Windows credentials, and Microsoft’s documented MFA route for Remote Desktop Services adds RD Gateway, NPS and Microsoft Entra ID around it. U2 Secured instead adds the second factor to the Windows sign-in on the server, with one MSI.
- Does it work with domain or Entra ID accounts?
- Not today. It protects local Windows accounts, and domain and Entra ID accounts are not supported. If your people sign in to servers with domain accounts, this is not the right fit yet.
- Which Windows versions has it been run on?
- Windows Server 2025, end to end against the live service with a real iPhone: a silent install, Remote Desktop, sign-in, unlock, a denied push, offline codes, the sign-in log and uninstalling. Other editions have not been tested yet.
- Is it on-premises?
- No. U2 Secured is a hosted service, so there is no server of yours to run and nothing to self-host. Each machine does hold what it needs to check offline codes itself, so sign-ins keep working when it cannot reach us.
- Is it free?
- The Developer plan is free: 1,000 active users and 100 push approvals a month, with one app. Codes from the app and backup codes are unlimited on every plan. Paid plans start at $99 a month.
- Is the installer code-signed?
- Not yet. Version 0.2.0 is unsigned, so Windows shows “Unknown publisher” and SmartScreen may warn about it. Check its SHA-256 against the published SHA256SUMS before installing. Code signing is waiting on its final validation, and a signed build follows as soon as that completes.
- What happens when someone reconnects to a disconnected session?
- The remote screen shows the tile with a Sign in button. One click and the push follows, then the session resumes once it is approved.
- Can I lock myself out of a remote server?
- Only members of “U2 Secured Users” are asked, so keep one local administrator outside the group as the emergency account: it signs in with its password alone through the same tile. Add one person first and test before adding the rest.
- Should RDP still stay off the public internet?
- Yes. A second factor protects the sign-in after the password. Keep the usual limits on who can reach port 3389, such as a firewall or a VPN, and keep the server patched.
Sources for the Microsoft side
Every Microsoft entry above was read from Microsoft Learn on the date shown. Microsoft updates its products and documentation; its pages are the authority if anything here has changed.