Two-factor sign-in for Windows and Remote Desktop
After the password, every sign-in, unlock and Remote Desktop session on your Windows PCs waits for a tap on the U2 Secured Authenticator app, with the number on screen to match. When a PC cannot reach the network, a code from the same app gets the user in.
One silent MSI on each PC, one app for the fleet, and a log in the developer portal of who signed in where, including the sign-ins a PC decided while it was offline.
What it protects, and how
Number matching, not a bare Approve
The sign-in tile shows a number and the phone shows three, under “Windows sign-in as alice on reception-pc”. The user taps the one that matches and Windows signs them in, with nothing to press on the PC. A wrong number or a Deny refuses the sign-in.
Sign-in, unlock and Remote Desktop
The same approval guards the Windows sign-in screen, unlocking a locked session, and Remote Desktop sign-ins to the PC. Windows checks the password first, so a wrong password never reaches the phone.
No tile that skips it
On a protected PC, Windows’ own password, PIN and Windows Hello tiles are hidden for every account. The U2 Secured tile is the only way in, so nobody can step around the second factor by picking another one.
Works offline
If the PC cannot reach U2 Secured, or the phone does not answer, the tile asks for a code from the authenticator app or a one-time backup code. The code is checked on the PC itself.
A silent MSI and a sign-in log for the fleet
One msiexec line, pushed with your deployment tool, such as Intune or Group Policy, installs the PC and registers it with a short-lived token. Each PC gets its own key, sealed by its TPM where it has one, and appears in the portal with every sign-in, including the offline ones it reports when it is back online.
Lockout safety built in
Only members of the local “U2 Secured Users” group are asked for U2, so you roll it out one person at a time, and an emergency administrator kept outside the group keeps a password-only way in.
Set up in four steps
The full guide, with every MSI property, how to verify each sign-in and where the Event Log records each decision, is in the developer docs.
- 1
Create an app for your PCs
In the developer portal: one app for the fleet, named after it, because that name is what users see on every approval. Create a registration token on its Machines tab.
- 2
Install the MSI on every PC
Download it from https://u2secured.com/downloads/windows/u2secured-windows-0.2.0-x64.msi and check its SHA-256 against https://u2secured.com/downloads/windows/SHA256SUMS. Run it silently from an elevated prompt or your deployment tool; the PC registers during the install, and nobody is asked for U2 yet.
msiexec /i u2secured-windows-0.2.0-x64.msi /qn REGISTRATION_TOKEN=rkr_… MACHINE_NAME=<name> - 3
Enrol each person
u2auth-admin enroll links a local account to the app and sets up their offline codes. Each person pairs their phone with the U2 Secured Authenticator once.
- 4
Add them to the group
Put each enrolled person in “U2 Secured Users”. Sign in as the first one while the emergency administrator is still signed in, then add everyone else.
What it costs
The same developer plans as every other U2 Secured integration. The free Developer plan is enough to try it on a few PCs.
| Plan | Price | Includes |
|---|---|---|
| Developer | Free | 1,000 active users and 100 push approvals a month, 1 app. Codes are unlimited. |
| Growth | $99/month | 25,000 active users and 100,000 push approvals a month, 5 apps. Codes are unlimited. |
| Team | $149/month | 75,000 active users and 300,000 push approvals a month, 20 apps. Codes are unlimited. |
| Scale | $199/month | 250,000 active users and 1,000,000 push approvals a month, unlimited apps. Codes are unlimited. |
One flat monthly price per developer account, not a price per user or per machine. A fleet of servers is one app; each person who signs in counts once a month however many machines they use. Codes from the app (TOTP) and backup codes are never metered on any plan.
Questions administrators ask
- What happens if U2 Secured is down or the PC is offline?
- The tile asks for a code from the authenticator app or a one-time backup code, checked on the PC itself. The same happens when a push goes unanswered for about a minute. The PC reports those sign-ins to the portal once it is back online.
- Can a user skip U2 Secured with a PIN or Windows Hello?
- No. Windows’ own password, PIN and Windows Hello tiles are hidden for every account on a protected PC, so every sign-in goes through the U2 Secured tile.
- Can I lock myself out?
- Only members of “U2 Secured Users” are asked, so keep one local administrator outside the group as the emergency account: it signs in with its password alone through the same tile. Add one person first and test before adding the rest.
- Which Windows has it been run on?
- Windows Server 2025 on a PC with a TPM, end to end against the live service with a real iPhone: a silent install that registers the PC, sign-in, unlock, Remote Desktop, a denied push, offline authenticator and backup codes, the sign-in log and uninstalling. It protects local Windows accounts.
- How is it priced: per user or per PC?
- Neither. Each developer account pays one flat monthly plan. A person counts once a month as an active user however many PCs they sign in to, and codes are never metered.
- Where do users get the app?
- The U2 Secured Authenticator is free on the App Store and Google Play. The same app holds the offline codes, and ordinary two-factor codes for other sites too.