AuthLite Interactive Documentation
Home
Contents
CLOSE
AuthLite Interactive Documentation
Quick Start: Install and protect Domain Admins AuthLite Features Supported Tokens
How AuthLite uses YubiKeys
Installation and Upgrading
What platforms are supported? Prerequisites and Installation Linux systems MacOS machines
Configuration
Licensing AuthLite Set up User Groups
Configuring AuthLite to use your Group Pairs
Setting up the "Group for New Users"
Enforce 2-factor Logons
Use Group Policy to enforce 2-factor on Windows servers/workstations Secure Administrative Accounts with 2-factor Authentication Enforce 2-factor on File Shares using Access Control Lists (ACLs) Partial enforcement of a server (e.g. Exchange) with "Forced 2-factor Processes" Enforce non-Windows machines with "Forced 2-factor Computers" Enforce 2-factor logon to Office 365 with AuthLite LDAP logon support/enforcement
Windows Workstation (Endpoint) Protection
Offline Workstation logon with YubiKeys Offline Workstation logon with OATH tokens Zero-client two-factor workstation logons Workstation Safe mode operations
Remote Desktop
2FA over Remote Desktop Protocol 2FA with Remote Desktop Gateway / RemoteApp / RDWeb / RD Web Client
Replay Windows to support RDP and other re-authenticating protocols Replay Behavior setting VPN and RADIUS Configuration
Using IAS/NPS for RADIUS with AuthLite Microsoft VPN Client settings Wireless 802.1x Authentication DirectAccess and NetMotion Mobility XE Configure Watchguard SSL VPN with AuthLite
Active Directory Deployment Notes
Token Management
First: Configure Token Settings Provisioning Tokens Administratively
YubiKeys (Soft) OATH Tokens (Hardware) OATH Tokens OnlyKeys
User Self-Service
"Enroll in AuthLite" Windows program SET UP the Self-Service Web Portal USING the Self-Service Web Portal
View/Edit Existing Tokens Delegate Token Management Recovery Tokens Multiple OTP Tokens for the Same User Multiple users with the same OTP Token Password Operations
How to Log In
CLOSE

"Enroll in AuthLite" Windows program

Fig. 1) User Enrollment on a (possibly remote) workstation
Fig. 1) User Enrollment on a (possibly remote) workstation

Prerequisites

  • AuthLite v2.4 or later on DCs and user's workstation
  • On workstation, select the Enroll in AuthLite shortcut to be available (or run SelfProvisionUI.exe from the AuthLite install folder)
  • To enroll a user, their workstation must currently be able to see the DCs on the LAN (being connected to a VPN is fine)
  • The workstation should be receiving a Group Policy that enforces 2F logon for AuthLite users

The "Enroll in AuthLite" tool allows the currently logged-in domain user to:

  • Bootstrap themselves into AuthLite, if they are not already in the group
  • Provision new YubiKey tokens (either un-programmed, or else already programmed and imported but not assigned yet)
  • Provision OATH soft tokens

It also automatically caches the user's offline data for YubiKeys (and Offline OATH tokens, if any) such that next time the user logs in they will be required to use their token.

Having all these features in one workstation tool ensures that all necessary steps are accomplished in the right order so that the user's offline cache is set up correctly no matter how they logged on, even if they are on a VPN and might be disconnected soon after.

Although not initially designed to be used this way, you can "Run as" this tool as a different domain user by shift-right-clicking its icon and saying "Run as a different user". It will require authentication to launch the app, and then the user will also have to authenticate again inside the app itself. 

This may be useful if the desktop logged-in user is not the same one you wish to provision. However if you are merely trying to provision users administratively, see this section instead.