Login for Windows configuration guide

The Identity Platform does not currently support duplicate usernames in multiple data stores. Login for Windows will not authenticate end users if their usernames are duplicated across multiple data stores.

Customers who want to use the pre-login assessment service must create the questionnaire themselves. SecureAuth does not host this document; rather, SecureAuth enables customers to integrate their own questionnaire with the Identity Platform version 19.07+ and Login for Windows version 20.09+.

Login for Windows does not support non-domain joined devices. Issues pertaining to account synchronization are the responsibility of the customer and not SecureAuth.

If a computer is not domain-joined AND all local users are blocked by Adaptive Authentication OR are not Active Directory (AD) or Microsoft Entra ID (formerly Azure AD) members on SecureAuth Identity Platform, end users receive the following message: "Access is denied for all users on this computer."

Login for Windows supports the samAccountName login name format if using Microsoft Active Directory or Microsoft Entra iD; in this use case, userPrincipalName (UPN) is not supported.

UPN is supported at login if running Login for Windows with a non-AD profile store containing OATHSeed/OATHToken/PNToken. In this use case, samAccountName is not supported, so the multi-factor authentication lookup will fail and the user will be unable to use other multi-factor authentication methods.

With the exception of the Microsoft-provided credential providers, SecureAuth does not support other third-party credential providers installed on the same computer as the Login for Windows credential provider.

SecureAuth did not certify Windows 7 and Windows Server 2008 with Login for Windows release 20.03+ because Microsoft deprecated both operating systems as end-of-life. Be aware of the following: