Touch-AcceptCloud
The user's Mideye+ app rings; one tap on Approve completes the logon. SMS magic-link fallback for users without the app installed. Reduces phishing risk, since there is no one-time code to trick out of the user.
Mideye Credential Provider · Early access
MFA for Windows RDP and logon.
A native credential provider DLL that adds Mideye two-factor authentication at the Windows logon screen itself, on every Remote Desktop session and console logon. Drops in alongside your existing Mideye deployment with no backend changes.
- Per-machine drop-in
- Cloud or air-gapped on-prem
- MSI or Group Policy
Why the logon screen
The gap your other integrations can't reach.
Your Mideye Authentication Service already covers VPN, RADIUS-protected apps, ADFS, and RDS. The credential provider extends that protection to the Windows logon screen itself, on every host where users RDP in or sit down at the console. The user types their Windows password as usual; Mideye then prompts for a Touch-Accept on the Mideye+ app, an SMS magic link, or a hardware-token OTP. Windows finishes the logon only when MFA succeeds. No other tile, no fallback, no shortcut.
Closes the RDP attack surface
Stolen credentials are the leading vector for ransomware on Windows fleets. The credential provider intercepts every RDP and console logon, regardless of which application the user is heading for.
Same Mideye, no backend changes
Talks to the same Mideye Authentication API or on-prem Mideye Server you already use. A signed MSI lays down two COM DLLs and a configuration tool. No second backend, no new identity store, no AD schema changes.
Air-gapped option
On-prem mode talks to a local Mideye Server over a static Bearer token. Hardware-token OTP, no internet egress required.
Authentication methods
Three ways to approve a logon.
The credential provider chooses based on what's configured per user, so there is no method picker for the user to fumble.
Hardware token OTPCloud + on-prem
One-time codes from HID and YubiKey hardware tokens. Press the button or tap the key, type the code, in. The only method that also works fully air-gapped.
Assisted LoginCloud
Four-eyes approval: the user requests; an approver on a separate phone confirms. Approvers can be local SAM users, AD domain users, or external phone-only contacts with no Windows account on the host.
Deployment modes
Cloud or on-prem, picked per machine.
Same MSI, same configuration tool, same docs. A single registry value (Mode) picks the backend.
Cloud mode
- OAuth2 client credentials → Mideye Authentication API
- Touch-Accept, SMS magic link, hardware-token OTP, Assisted Login
- Server-Sent Events for instant logon feedback
- Outbound HTTPS only, port 443
One registry value:
Mode On-prem mode
- Static Bearer token → local Mideye Server
- Hardware-token OTP only
- No internet egress required
In on-prem mode, Touch-Accept and Assisted Login are force-disabled at startup, since the local Mideye Server has no corresponding endpoints.
Safe defaults
Fails closed, without locking you out.
Built to keep secrets away from non-admin eyes, keep PII out of the logs, and make a bad deploy harmless.
Lockout-resistant
A misconfigured deploy is silently inactive, not lockout-causing. Activation refuses without at least one configured Break-Glass principal.
Secrets locked down
API credentials live in a registry key readable only by SYSTEM and Administrators, and are never written to logs or exports. They never leave the host.
PII masked in logs
Phone numbers and token serials are masked in every log line, including in debug mode. Break-Glass logons are audited individually via Windows Event Log.
Deployment
One signed MSI, three delivery paths.
1
Interactive MSI
Pilot install on a single host: wizard, license, install, configure.
2
Silent MSI
msiexec /qn for SCCM, scripted rollouts, and custom orchestration. Per-host JSON config applied separately.
3
Group Policy
Software Installation policy plus a startup script that applies the per-OU JSON config. Built for AD-joined fleets.
Documentation
Where to read next.
Feature overview
What each piece does: install, registry config, cloud / air-gapped, login schedule, Break-Glass, per-user overrides, approvers, customisation.
Read the overviewQuickstart
Zero to MFA on RDP in ~10 minutes: install, paste Client ID and Secret, add Break-Glass, activate, enforce on RDP.
Open the quickstartArchitecture
How the credential provider DLL plugs into Windows LogonUI; the MFA decision ladder; cloud and on-prem flow diagrams.
See the architectureFAQ
Frequently asked questions.
How do I add MFA to Windows Remote Desktop (RDP)?
Install the signed Mideye Credential Provider MSI on every Windows host where RDP terminates, paste the Client ID and Secret from your Mideye Authentication Service, configure at least one Break-Glass principal, then activate. The Mideye tile replaces the default Windows password tile and prompts for a second factor on every RDP and console logon. Install and configuration take about 15 minutes per host.
Does Mideye Credential Provider work without internet?
Yes. In on-prem mode it talks to a local Mideye Server with a static Bearer token and supports hardware-token OTP only, no internet egress required. Cloud mode uses outbound HTTPS to the Mideye Authentication API and adds Touch-Accept and Assisted Login. A single registry value picks the mode per machine.
What Windows versions are supported?
Windows Server 2019, 2022, and 2025, plus Windows 10 (22H2) and Windows 11 (23H2 or later) desktops. x64 only. Both Active Directory domain-joined hosts and workgroup / standalone hosts are supported. Entra-ID-only joined machines are not currently tested or supported.
Is the Mideye Credential Provider generally available?
It is in early access. Everything described on this page is implemented and documented, and we are running supervised pilot deployments ahead of the 1.0 release. Contact us to join the early-access programme and we will plan the rollout with you.
Ready to evaluate?
Run the 10-minute quickstart on a test VM, or talk to us about an early-access pilot in your environment.