SafeNet Agent for Windows Logon

SafeNet Agent for Windows Logon is a lightweight software that is installed on Windows machines to augment logon security by invoking Multi-factor Authentication (MFA). It ensures that valuable resources are accessible only by authorized users. The agent also protects desktop applications and processes which use CredUI.

The use of MFA in addition to AD authentication adds another layer of security. The agent provides a secured and consistent logon experience to the end users of Windows machines.

This is a preview feature. Contact Thales Customer Support to request access to preview features.

For information about the released features, see: SafeNet Agent for Windows Logon.

Preview Release Description

v4.4.0

This preview release introduces the following features

• Support for User Choice of Authenticator (UCA): UCA allows users to select from their available authentication methods during Windows logon. When a user signs in, they are presented with a list of the authentication methods they have enrolled in SafeNet Authentication Service Private Cloud Edition (SAS PCE). To disable UCA, set the value of the DisableUCA registry key to 0. For more information, see Registry settings.

• Support for FIDO2 authenticators: FIDO2 (Fast IDentity Online) is a set of open standards designed to provide phishing-resistant and strong authentication. FIDO authentication in the SafeNet Agent for Windows Logon aims to eliminate passwords for online authentication, offering a more secure and user-friendly experience.

  Note

  FIDO support in this release is tested with Thales FIDO authenticators.

• Support for Passwordless Windows Logon: The Passwordless Windows Logon feature is MFA based on X.509 (PKI) standards, but without the inherent complexities of a typical PKI solution. It eliminates the need for passwords for machine access, enhances the overall security posture of enterprises, and augments the end-user experience by minimizing user friction. It also reduces operational expenses due to minimized help desk calls for password resets.

  • Two registry settings, PasswordlessEnabled and PasswordlessGroup, have been added to support passwordless logon. For more details, see registry settings.

  • While authenticating with passwordless logon, ensure that you configure the registry settings.

• Lock screen on FIDO USB authenticator removal: When you authenticate to your Windows system using a FIDO USB authenticator, the system locks automatically.It is an optional feature, for more details, see registry settings.

Resolved Issues