RDP Guard : Windows

Version: 1.0.41 | Updated: 2026-07-01
Verified on: Windows 11 23H2 + Windows Server 2022 (both Workgroup) ✅
Other supported OS: Windows 10 22H2, Windows Server 2019 / 2025, Win11 24H2

⚠️ Run the pre-install checklist first.
90% of "Authyo tile doesn't appear" and "RDP signs me in without OTP"
tickets are caused by a missed prerequisite. The
PRE-INSTALL-CHECKLIST.md ships a self-check
PowerShell script that verifies every requirement in 30 seconds — run
it on each target server before installing the MSI. The installed
Configurator also has a built-in Diagnostics tab that runs the same
checks (see Diagnostics).

Authyo RDP Guard adds an OTP challenge to the Windows logon screen. After
install, every interactive sign-in (and RDP session reaching the lock
screen) requires both a valid Windows password and a one-time code
that goes to a pre-configured admin contact — with offline break-glass
options (Google Authenticator / backup codes) so you are never locked out.

⚠️ Read this first

Authyo RDP Guard installs as a Windows Credential Provider — it
participates in the OS sign-in flow. While the installer is small and
the uninstall is clean, you should:

Pilot on one server first. Don't roll out to the whole fleet on day
one. Install on a single staging machine, sign in via the new tile a
few times, then expand.
Configure a break-glass path before you rely on it. Add at least
one bypass user (password-only) and enrol Google Authenticator
(TOTP) for an admin. TOTP works even when Authyo is unreachable — it
is the one recovery path that survives an outage on a remote RDP box.
The Configurator warns you at Save time if no offline recovery exists.
Keep a second local Administrator account active before installing.
Have a system restore point if you're paranoid.

If anything goes wrong at the logon screen: Safe Mode → sign in as the
rescue admin → Settings → Apps → Authyo RDP Guard → Uninstall. Windows
does not load third-party credential providers in Safe Mode, so the plain
password tile is always available there. See Recovery.

What's in the box

A single MSI: AuthyoGatekeeper-1.0.47.msi (≈1.4 MB).

Files installed

Path	Purpose
`C:\Program Files\Authyo\Gatekeeper\Authyo.Gatekeeper.CredentialProvider.dll`	The Credential Provider that adds the Authyo tile to the logon screen
`C:\Program Files\Authyo\Gatekeeper\Authyo.Gatekeeper.Bridge.dll`	C++/CLI shim that hosts the .NET 8 runtime inside LogonUI
`C:\Program Files\Authyo\Gatekeeper\Authyo.Gatekeeper.Core.dll`	Managed library — HTTP client, JWT, DPAPI, SQLite trust cache, TOTP
`C:\Program Files\Authyo\Gatekeeper\Authyo.Gatekeeper.Configurator.exe`	WPF wizard for setup + the Diagnostics self-check
`C:\Program Files\Authyo\Gatekeeper\Ijwhost.dll` + SQLite libs	.NET 8 host + dependencies
`C:\ProgramData\Authyo\Gatekeeper\`	Where `config.json`, `trust.db`, and logs live after first run

Registry entries

Key	Purpose
`HKLM\SOFTWARE\Classes\CLSID\{B251F0AF-6D20-4C4D-90ED-4ADE0D8256D7}`	COM registration of the CP
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B251F0AF-...}`	Tells LogonUI to load us
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{B251F0AF-...}`	Filter registration (hides the password tile on RDP sessions)

Plus an Add/Remove Programs entry ("Authyo RDP Guard — Konceptwise
Digital Media Pvt. Ltd.") and a Start Menu shortcut to the Configurator.

Pre-requisites

Before installing the Authyo RDP Guard MSI:


OS	Windows 10 22H2, Windows 11 23H2/24H2, Windows Server 2022, or Windows Server 2025 (workgroup or domain-joined)
.NET 8 Desktop Runtime	Required. The MSI does not bundle the framework. Download: https://dotnet.microsoft.com/download/dotnet/8.0 → ".NET Desktop Runtime 8.0.x (x64)"
Administrator rights	Required at install time and to launch the Configurator
Network reachable	Machine must be able to reach `app.authyo.io` over HTTPS (port 443)
Authyo application	You need a Client ID + Client Secret from an active application at https://app.authyo.io
RDP Guard license key	Activation is required in the Configurator before you can save a config. Obtain a key from the RDP Guard section of the portal.

To check .NET 8 is installed:

dotnet --list-runtimes

You should see a line containing Microsoft.WindowsDesktop.App 8.0.x.

Install — step by step

1. Get your Client ID and Client Secret

Log into https://app.authyo.io → Applications → either pick an
existing application or create a new one. From the application detail
page, copy the Client ID and Client Secret. Keep them safe —
you'll paste them into the Configurator in step 4.

2. Download the MSI

In the same Authyo portal, go to RDP Guard in the left menu.
Download AuthyoGatekeeper-1.0.47.msi under the Windows card.

3. Run the installer

Right-click the downloaded MSI → Run as administrator.

You may see a Windows SmartScreen warning. Click More info → Run
anyway to proceed.

The installer:

Accepts the license agreement
Asks for an install location (default: C:\Program Files\Authyo\Gatekeeper\)
Installs files, writes registry entries, registers the Credential Provider
Offers to launch the Authyo RDP Guard Configurator at the end

Keep the "Launch Configurator" checkbox ticked and click Finish.

4. Configure with the Configurator

The Configurator window opens. Work through the fields:

Credentials + license

Field	What goes here
Client ID	From step 1
Client Secret	From step 1. Encrypted with Windows DPAPI before being saved — it never sits on disk in plaintext.
API endpoint	`https://app.authyo.io` (already pre-filled)
License key	Your RDP Guard key. The Configurator activates it against the server before it lets you save — a blank key or a failed activation blocks Save.

Admin contacts + how the OTP is routed

Add one or more contacts (+ Add another admin contact). Each contact
has a Name, a Recipient (email or phone with country code, e.g.
919876543210, no + or spaces), and a Channel (Email, Sms,
Whatsapp, or VoiceCall).

How delivery works (this changed since v1.0.0 — read this):

The first OTP goes to the first matching contact only — never a
fan-out to every channel at once.
Routing mode decides which contact:
- Per-user routing (recommended, what the wizard sets up): the OTP
  goes to the contact whose Name matches the Windows username signing
  in (case-insensitive; a leading DOMAIN\ is ignored). A contact
  named admin or Administrator is the catch-all fallback if
  no name matches. Give one user several channels by adding multiple
  contacts with the same Name.
- Central-admin routing: every sign-in goes to the same contact list
  regardless of who logs in (the classic gatekeeper model). This is the
  fallback for a hand-edited config that doesn't set a routing mode.
The old contactPolicy options (PrimaryOnly / RoundRobin /
AllInOrder) are no longer used for delivery. The field may still
appear in config.json for backward compatibility but is ignored — do
not rely on it.

Trusted device window

Field	What goes here
Trust hours	`0` = always require OTP (most secure, recommended for production). A higher value skips OTP for repeat sign-ins from the same IP + user within that window.

Break-glass (so you can never lock yourself out)

Field	What it does
Bypass users (break-glass access)	Windows accounts listed here sign in with password only, no OTP. One username per line or comma-separated. Bypass works at the local console only, not over RDP.
Enrol Google Authenticator (TOTP)	Offline break-glass. Scan the QR with Google Authenticator (or any TOTP app), confirm one live code, and that admin can sign in with a rotating 6-digit code even when Authyo is unreachable. This is the only recovery path that survives an outage on a remote RDP box.

Backup codes (single-use) are generated separately in the Authyo web
dashboard — see Break-glass options.

Test, then save

Click Send test OTP. You should receive the OTP within ~10 seconds.
If not, check your Client ID/Secret, that the Authyo application has an
auth priority set for the channel you picked (Active = true, Priority ≥ 1),
and that the contact address is reachable.

Before it saves, the Configurator runs its Diagnostics
and blocks Save on any critical failure (config folder not writable,
secret won't decrypt, .NET 8 runtime missing, install DLLs missing, or
license not activated). It will also warn — but let you proceed — if
you have break-glass enabled but no offline recovery configured, or if
the current admin has no OTP contact and isn't a bypass user.

Once saved:

Saved to C:\ProgramData\Authyo\Gatekeeper\config.json. Lock the screen
(Win+L) to see the Authyo RDP Guard tile.

Press Win+L to lock the screen. You should see the Authyo RDP
Guard tile alongside the standard Windows tiles.

Type your Windows username
Type your Windows password (the field has a reveal/eye button)
Click the → arrow (Submit)
Wait for the OTP to arrive. The prompt names the channel and masked
recipient, e.g. "OTP sent via Email to nav***com"
Type the OTP (the field has a reveal button)
Click → again

Windows logs you in.

If the OTP doesn't arrive: after a short countdown a Resend OTP
link appears. The tile shows a 60-second countdown; the server will
accept a resend after 30 seconds. Each resend auto-advances to your
next channel for the same person (e.g. Email → Sms → Whatsapp) — the
link updates to "Resend OTP – try Sms". Only one OTP is ever active at a
time (a resend invalidates the previous code).

If Authyo can't deliver at all, the tile then reveals the free
break-glass options — "I have a backup code" and, if enrolled, Google
Authenticator. These appear only after the paid OTP path fails.

6. Verify it's working

Open PowerShell as Administrator and run:

Get-Content 'C:\ProgramData\Authyo\Gatekeeper\logs\gatekeeper.log' -Tail 10

You should see a sequence like:

INFO   user=naveen ip=console GATE_START
INFO   user=naveen ip=console SENDOTP_OK contact='naveen' via=Email to=nav***com maskId=...
INFO   user=naveen ip=console JWT_VERIFIED
INFO   user=naveen ip=console GATE_PASS

GATE_PASS is the final success marker. Other markers you may see:
BACKUPCODE_OK, TOTP_BREAKGLASS GATE_PASS, GATE_DISABLED (server
kill-switch), LICENSE_OK / LICENSE_LAPSED (licensing status),
GATE_FAIL_OPEN (allowed because Authyo was unreachable and fail-open
was configured).

Diagnostics (built-in self-check)

The Configurator has a Diagnostics tab that runs 10 checks and offers
one-click fixes. It runs on demand and again automatically before Save.

#	Check	Blocks Save?
1	Config folder exists and is writable	✅ critical
2	Folder ACL is Administrators + SYSTEM only	one-click fix
3	Config file valid & secrets decrypt (DPAPI)	✅ critical
4	.NET 8 Desktop Runtime present	✅ critical
5	Credential Provider registered	one-click fix (reinstall hint)
6	Install DLLs present	✅ critical
7	NLA status (advisory for RDP)	warn only
8	At least one break-glass recovery path	warn only
9	Current user can actually sign in	warn only
10	Authyo reachable	warn only

Critical failures block Save; advisory items warn but let you proceed.
One-click fixes are offered for creating the config folder and tightening
the folder ACL.

Day-to-day usage

Using Authyo RDP Guard with Remote Desktop (RDP)

Install Authyo RDP Guard on the server you want to protect, not on
the client machines. When someone connects with mstsc, the server's
logon screen renders inside the RDP window and your Authyo tile appears
there exactly like on the physical console.

One-time server prep — disable NLA. Network Level Authentication is
on by default on Windows Server 2022 and bypasses Credential Providers.
On every server where you install RDP Guard, disable NLA so the RDP login
renders through LogonUI and our tile fires:

# Run on the server (elevated PowerShell) once after installing RDP Guard
(Get-WmiObject -class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)

Important — console vs RDP. The credential-provider filter hides
the standard password tile only for remote (RDP) sessions. At the
physical console — and at a cloud serial console (AWS EC2 Serial,
Azure Serial Console, GCP serial) or hypervisor console — the normal
password tile is always shown. That console path is your recovery route
if OTP ever can't be delivered on a remote box.

Test from a client:

mstsc /v:your-server.example.com

RDP reconnect to a disconnected session also fires the OTP gate
(Windows raises CPUS_UNLOCK_WORKSTATION). Each reconnect = another OTP.
This is intended security behavior.

Multiple servers, one webhook — telling them apart

If you point several servers at the same logging webhook URL, every
log line now carries the server's identity so your receiver can filter by
it. The JSON envelope is:

{ "ReportingStatus": {
    "Subject":    "RdpGuardLog",
    "ServerHost": "WIN-DB01",
    "LicenseKey": "RDPG-XXXX-XXXX-XXXX-XXXX",
    "Timestamp":  "2026-07-01T14:23:45+05:30",
    "Level":      "INFO",
    "Message":    "user=naveen ip=console GATE_PASS",
    "Raw":        "2026-07-01T14:23:45+05:30  INFO   user=naveen ip=console GATE_PASS"
} }

ServerHost is the machine name (automatic — no config needed).
LicenseKey is the server's licence key (omitted while a box is
not yet activated). It is not secret to you — you own both ends.
Subject is RdpGuardLog on Windows and PamGuardLog on Linux, so
you can also tell the two platforms apart.

Set the webhook under webhook.url in config.json (empty = disabled).
Delivery is fire-and-forget: a slow or down receiver never delays sign-in,
and the on-disk log is always the source of truth.

Adding or changing admin contacts

Re-launch Authyo RDP Guard Configurator from the Start Menu, edit the
contacts, click Save config. Changes take effect on the next sign-in —
no reboot needed.

Break-glass options

You have four ways to get in when the normal OTP can't be delivered:

Method	Works offline (Authyo down)?	Where
Google Authenticator (TOTP)	✅ Yes — verified locally	Enrol in Configurator
Backup code	❌ No — needs Authyo reachable	Generate in Authyo dashboard → "Backup codes (RDP Guard only)"
Bypass user	✅ Yes — but local console only, not RDP	Configurator "Bypass users"
Trusted device window	✅ Yes if the IP+user signed in recently	Configurator "Trust hours"

Backup codes: generated once in the dashboard (default 10),
displayed as XXXX-XXXX-XXXX, each usable once. On the tile, click
"I have a backup code" and type it.
TOTP / backup-code prompts only appear AFTER the paid OTP fails —
this protects your OTP spend while keeping recovery available.

The one true lock-out is: remote RDP and Authyo unreachable
and no TOTP enrolled and no trust window and no bypass that
works remotely. The fix is prevention — enrol TOTP for at least one
admin. Recovery from that state requires console/serial access to
get in locally and disable the gate. See
RUNBOOK-authyo-down-recovery.md.

Temporarily disabling OTP

Delete or rename C:\ProgramData\Authyo\Gatekeeper\config.json. When the
config is missing, the Authyo tile hides and users sign in via the
standard Windows password tile. Restore the config to re-enable.

Remote kill-switch (from the portal)

An admin can disable a specific server from the Authyo portal. On the
next sign-in the gate fails closed and denies the login (log marker
GATE_DISABLED) until it's re-enabled. This is distinct from a license
lapse — a lapsed/suspended license still enforces OTP but never blocks
sign-in. The flag is cached from the periodic heartbeat, so it survives a
brief network outage.

Logs

File	What's in it
`C:\ProgramData\Authyo\Gatekeeper\logs\gatekeeper.log`	Plain-text log of every sign-in attempt (markers above)
Windows Event Viewer → Application	Anything that fails before our log is initialized — useful if the CP itself can't load

Logs are append-only and rotate weekly.

Recovery — emergency access

If the Authyo tile ever blocks you, in rough order of preference:

Another break-glass path: TOTP code, backup code, or a bypass user
at the console (see Break-glass options).
Console / serial access: the password tile is never hidden at the
physical or cloud-serial console. Sign in there and disable the gate.
Safe Mode: reboot with Shift+Restart → Troubleshoot → Advanced →
Startup Settings → 4. Third-party credential providers don't load
in Safe Mode, so the plain password tile works. Sign in as a local
admin → Settings → Apps → Authyo RDP Guard → Uninstall.
Emergency rescue script (authyo-rescue.ps1), run elevated:
```
powershell -ExecutionPolicy Bypass -File .\authyo-rescue.ps1
```
It best-effort uninstalls the MSI and force-removes the three
credential-provider registry keys. By default it KEEPS your config;
add -PurgeData to also delete C:\ProgramData\Authyo\Gatekeeper\.
Reboot (or lock+unlock) afterward and sign in with the normal password.

Install-media recovery (last resort): boot from Windows install
media → Repair → Command Prompt →

reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B251F0AF-6D20-4C4D-90ED-4ADE0D8256D7}" /f

→ reboot.

Uninstall

Settings → Apps → Installed apps → Authyo RDP Guard → Uninstall

Or from elevated PowerShell:

$app = Get-WmiObject Win32_Product -Filter "Name='Authyo RDP Guard'"
$app.Uninstall()

The uninstaller removes the Authyo DLLs, the three registry entries, the
Start Menu shortcut, and the Add/Remove Programs entry. It does not
remove C:\ProgramData\Authyo\Gatekeeper\ (your config.json and
trust.db). For a full purge:

Remove-Item 'C:\ProgramData\Authyo' -Recurse -Force

If you disabled NLA and are removing RDP Guard, re-enable it:

(Get-WmiObject -class Win32_TSGeneralSetting `
    -Namespace root\cimv2\TerminalServices `
    -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(1)

After uninstall, the next Win+L shows only the standard Windows password
tile. No reboot required.

Troubleshooting

The Authyo tile doesn't appear on the lock screen

# Confirm the config exists and is readable
Get-Content 'C:\ProgramData\Authyo\Gatekeeper\config.json'

# Confirm the Credential Provider is registered
$clsid = '{B251F0AF-6D20-4C4D-90ED-4ADE0D8256D7}'
Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$clsid"

# Confirm .NET 8 Desktop Runtime
dotnet --list-runtimes   # expect Microsoft.WindowsDesktop.App 8.0.x

If all three are fine, run the Configurator's Diagnostics tab — it
pinpoints the failing prerequisite.

"OTP did not verify"

OTP expired (default 5 minutes) or you used an older one — use the most
recent code (a resend invalidates the previous one).
Retry up to 5 times within the maskId's lockout budget.

"Windows rejected the credentials"

The OTP verified but Windows didn't accept the password:

Confirm the username matches a local or domain account.
Confirm the password on the standard tile.
Microsoft Account (MSA) sign-ins use the MSA tile, not the Authyo tile.

RDP signs in WITHOUT an OTP

NLA is enabled — it bypasses credential providers. Disable NLA (see
RDP).

RDP is stuck at logon / "Cannot reach Authyo"

The machine couldn't reach app.authyo.io and blockOnAuthyoUnreachable
is true (the default, fail-closed). Confirm DNS/HTTPS/firewall:

nslookup app.authyo.io
Invoke-WebRequest https://app.authyo.io/ -UseBasicParsing

Use a break-glass path to get in (TOTP works offline). You can set
blockOnAuthyoUnreachable to false (fail-open) in config.json's
policy section — not recommended for production, and note that with
server-authoritative policy enabled a stale/unverified policy also falls
back to this setting.

Collecting a diagnostics bundle for support

Compress-Archive `
    -Path 'C:\ProgramData\Authyo\Gatekeeper\logs',
          'C:\ProgramData\Authyo\Gatekeeper\config.json' `
    -DestinationPath "C:\authyo-diagnostics-$(Get-Date -Format yyyyMMdd-HHmmss).zip"

The clientSecretEncrypted blob is DPAPI-encrypted, so the bundle is safe
to share. Email it to support@authyo.io.

Security notes

Client Secret + TOTP secrets on disk: encrypted with Windows DPAPI
machine-scope. Only the local SYSTEM context (which LogonUI runs as) can
decrypt. The blobs are useless if exfiltrated to another machine.
OTP transport: HTTPS to app.authyo.io, TLS 1.2+, server-cert
validated by the default Windows trust store.
JWT verification: every OTP/backup-code verify response carries a
JWT signed with HMAC-SHA256 using your Client Secret. RDP Guard validates
the signature locally — a forged "success" response without a valid
JWT is rejected even if the HTTP body says success: true.
TOTP break-glass: verified fully offline (RFC 6238) with a
single-use replay guard (lastUsedStep) — a code can't be replayed.
Server-authoritative policy (optional, off by default): when enabled,
the server's signed policy (HMAC-SHA256, with anti-rollback versioning)
must be freshly verified before local exempt/trust short-circuits are
honored, so a local config.json edit can't grant a bypass. Ship it
off unless you specifically need it.
Trust device cache: trust.db is a SQLite file storing source-IP +
username fingerprints (no passwords, no tokens). Bounded TTL, default 0.
No bypass of Windows auth: RDP Guard layers OTP on top of the
standard Windows logon. A valid OTP with a wrong Windows password is
still rejected by LSA.

For the full threat model, see SECURITY.md.

Support

Documentation: https://authyo.io/gatekeeper
Email: support@authyo.io
License: Apache-2.0 (the Linux PAM module) + Proprietary (the Windows
Credential Provider). See LICENSE in the install directory.