I See London, I See France

Just Another Person on the Internet's Rants

Menu

Skip to content
  • Home
  • Cookie Policy

Tag Archives: Provider

Windows: Disabling Password-Only Authentication After Enabling YubiKey Authentication

So, I received a generous gift of another YubiKey from [REDACTED] and wanted to configure one of my Windows machines to require YubiKey authentication – after having already done so on my Ubuntu machine.

I used the YubiKey Personalization Tool to set-up the HMAC-SHA1 on Slot 2 (as required for this to work) and then used the YubiKey Logon Administration tool to configure Windows to require the YubiKey for logon.

This worked but there was a problem…

You see, I now how two logon options, one to logon with the YubiKey and one to logon without (meaning only with the password) – both under the same Username because they were different logon providers pointing to the same NT account.

Well, this is no good. The whole point to creating a layer that’s difficult duplicate is because the password-only option allows brute-force over ‘x’ amount time to eventually win (the logic, here, being that given enough time, any combination of characters can eventually be guessed successfully).

So, how can we prevent this from being a plausible attack surface? Well… The answer lied buried in a bug filed on GitHub for the YubiKey Logon Administration tool:

Markering_029

The only viable answer was provided in an answer to the original bug on GitHub.

Alright, I fired-up regedit and went to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cfd-0b87f74ea6cd}

I created a DWORD key called Disabled and set it to Enabled (1). Then, I locked my desktop and, as expected, only the YubiKey login provider is now offered.

So, since it took so long to find, I figured a blog post was worth writing over it.

Thanks for coming to this NERDTalk™ and happy Windowsing!

2019-03-13iseelondoniseefrance_lx76x6 Authentication, Credentials, HMAC-SHA1, Logon, NT, NT Account, password, PasswordProvider, Provider, Windows 10, Yubico, YubiKey, YubiKey Logon Administration, YubiKey Personalization Tool
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy
Proudly powered by WordPress ~ Theme: Syntax by WordPress.com.