Step 1: Create a “Microsoft RDP” application in the Duo Admin Panel

1. Log in to the Duo Admin Panel
2. Go to Applications → Protect an Application
3. Search for Microsoft RDP and click Protect
4. Note down the generated values: Integration Key, Secret Key, and API Hostname

Step 2: Download Duo Authentication for Windows Logon

From the Duo Admin Panel, on the application you just created, download the installer DuoWindowsLogon64.msi (or .exe, depending on the version).

Step 3: Install the package on the server

Run the installer with administrator rights:

msiexec /i DuoWindowsLogon64.msi /qn ^
  IKEY="YOUR_INTEGRATION_KEY" ^
  SKEY="YOUR_SECRET_KEY" ^
  HOST="YOUR_API_HOSTNAME" ^
  AUTOPUSH="#1" ^
  FAILOPEN="#0" ^
  RDPONLY="#1"

Parameter explanation:

• AUTOPUSH="#1" — automatically sends a push notification to the phone at login
• FAILOPEN="#0" — if the Duo service is unavailable, access is blocked (more secure); set to #1 only if you prefer availability over strict security
• RDPONLY="#1" — applies 2FA only to RDP connections, not local console login (useful to avoid accidentally locking yourself out)

Step 4: Restart the server

Restart-Computer -Force

Step 5: Enroll users in Duo

For each user who will connect via RDP:

1. In the Duo Admin Panel, go to Users → Add User
2. Add the username identical to the Windows username (without domain, for local accounts)
3. Click Add Phone and scan the QR code with the Duo Mobile app on the user’s phone

Step 6: Test the RDP connection

From a client computer:

mstsc /v:SERVER_IP_OR_HOSTNAME

After entering the Windows password, an additional Duo prompt should appear (text-based, within the RDP window), with options such as:

Duo two-factor login for username

1. Push notification
2. Phone call
3. SMS passcodes

Passcode or option (1-3):

Select option 1 to receive a push notification on your phone, then approve it from the Duo Mobile app.

Step 7: Configure additional policies

In the Duo Admin Panel, on the Microsoft RDP application you created, you can set:

• New Device Policy — require re-verification for new devices
• Authentication Policy — restrict access from certain countries/IP addresses
• Remembered Devices — skip 2FA prompts on the same device for a set period of time

Additional recommendations

• Always start with RDPONLY="#1" so you don’t risk getting locked out of physical console access if there are network issues reaching Duo
• Test 2FA with a test account before applying it to primary administrator accounts
• In Active Directory environments, you can automatically sync users with Duo using the Duo Authentication Proxy, avoiding manual user creation.