Solutions/Active Directory/MFA
Windows & AD · Kerberos · NTLM · LDAP · SMB · RDP

Protect Windows logins with MFA—without changing your endpoints

Deploy the DC Sensor on your domain controllers. It evaluates domain authentications against policy and prompts for MFA when a policy requires it. No cloud sync, no proxy servers, no agent on workstations or member servers.

Enforcement topologyagentless
Workstation / RDP
Kerberos · NTLM
DC SensorDomain Controller
evaluate()
AuthNull MFA
push
approved ✓User's phone
When policy requires MFA, auth is held at the DC — the login waits, the runas never opens, the share stays locked — until the user approves.
Does
MFA on domain logons when policy requires it, held at the DC
Replaces
Password-only AD and RDP logons
Needs
The DC Sensor on your domain controllers
Setup
Same afternoon
Every access path

MFA for Windows and other AD-backed access.

Your IdP protects cloud apps. AuthNull applies MFA to the logins and services that authenticate against your domain: domain logons, RDP, runas and file shares. It protects the authentication, not the directory, so nothing in AD itself changes.

  • 01Domain authentication

    The DC Sensor on your domain controllers evaluates Kerberos, NTLM, LDAP and SMB authentications against policy, and prompts when a matching policy requires MFA. No cloud sync, no proxies, no agent on workstations or member servers.

    Kerberos · NTLM · LDAP · SMB

  • 02RDP, runas and file shares

    RDP sessions, runas commands and file-share access that authenticate against AD wait at the DC until MFA is approved, when policy requires it. RDP is covered through the domain authentication it triggers.

    RDP · runas · SMB shares

  • 03Domain admin accounts

    Require MFA on privileged logons — the accounts an attacker actually wants — while standard users follow your policy. Service accounts are detected and excluded from push.

    Domain Admins · tier-0

  • 04Windows servers

    Domain-account sign-ins to member servers and DCs, enforced from the DC Sensor with no agent on the server itself.

    2019 · 2022 · core
How enforcement works

The DC intercepts the auth, then holds it until the user approves.

Kerberos, NTLM, LDAP and SMB requests are evaluated against policy at the domain controller: allow, require MFA or deny. Service accounts are detected and excluded from push. Every decision is logged for audit.

Logon sequence
1user→DCAS-REQ Kerberos
2DC→authnullevaluate(user,src,proto)
3→phonepush · DC holds ticket ⏳
4phone→authnull approved
5DC→userTGT issued
authnull-dc — decisions.log
14:02:11 jdoe@CORP Krb src=10.0.4.12 → allow (in-office)
14:02:47 admin@CORP Krb src=203.0.113.9 → challenge push→wallet
14:02:52 admin@CORP ··· → approved, issue TGT ✓
14:03:20 svc-backup$ NTLM src=10.0.1.5 → skip (service acct)
14:04:05 mreyes@CORP SMB src=198.51.100.7 → deny (timeout)
Supported methods

Works with your existing Duo or Okta — no rip and replace.

AuthNull sits in front of AD and triggers push via the provider your users are already enrolled in. Bring your own Duo or Okta tenant, or use AuthNull Wallet directly.

AuthNull Wallet
primary · push notification
primary
Duo
existing Duo tenant · push
bring your own
Okta
existing Okta tenant · push
bring your own
Authenticator TOTP
offline-capable
coming soon
Decide · Conditional access

Conditional access for on-prem AD. No Entra needed.

Decide allow, push or deny from who, which group or OU, from where, at what time and on which machine. Domain Admins from outside the network always hit MFA, while a desk in the office stays out of your way.

UserGroupOUSource IP / geoTime of dayMachine
See conditional access
Policy · Privileged remote accessenabled
WHEN user in Domain Admins
AND source outside corp network
AND time 18:00 – 07:00
REQUIRE MFA
ELSE allow
Control · Sessions

RDP through the gateway. Every admin session on record.

Admin RDP sessions you route through the AuthNull gateway are verified with MFA, recorded, and can be ended from the console. The gateway is part of PAM and is set up separately; the DC Sensor on its own doesn’t route or record RDP. With just-in-time access and the vault, nobody keeps standing admin rights or passwords.

  1. 01 · Request

    Admin rights, only when asked

    Just-in-time access grants admin on the server for a set window. Nobody holds it standing.

    j.doe → win-app-03 · RDP
    Just-in-time access
  2. 02 · Verify

    MFA at the gateway

    The RDP session opens through the AuthNull gateway only after the push is approved.

    push approved
  3. 03 · Record

    The whole session on record

    Every admin session is recorded, and can be ended from the console while it runs.

    connected · recording
    See sessions
  4. 04 · Expire

    Nothing left behind

    When the window closes the rights go. The vault holds the password, so the admin never keeps one.

    access removed
    Credentials vault
Deployment, honestly

Two deployment modes. No agent on workstations or member servers.

The DC Sensor runs on your domain controllers and evaluates the authentications made against the domain. Add the RADIUS Bridge for VPN gateways and network gear that speak RADIUS.

Agentless

Recommended
User logonDomain ControllerAuthNull MFA
The DC Sensor runs on your domain controllers — no agent on workstations or member servers.Covers domain authentications from logon, RDP, runas and SMB file shares.Fastest path to coverage and the easiest to roll back.Requires the machine to reach AuthNull at logon time.

Use when: domain-joined Windows servers, desktops, and RDP access.

RADIUS Bridge

VPN · Network
VPN / FirewallRADIUS BridgeAuthNull MFA
For VPN gateways, firewalls, and network gear that speak RADIUS.Runs on a Linux server or Docker — no Windows agent required.Same AD identities, same MFA policy, every entry point.

Use when: Cisco, Aruba, Fortinet, or any RADIUS-capable VPN or firewall.

Live in an afternoon

Six steps from download to enforced.

01

Configure Active Directory

~ 10 min

Connect AuthNull to your AD via LDAP — domain, IP, search base, bind credentials. No schema changes.

02

Install the DC Sensor

~ 15 min

Deploy the lightweight DC Sensor on your domain controllers. It evaluates Kerberos, NTLM, LDAP and SMB at the DC — no agent on workstations or member servers.

03

Enroll users

~ 5 min / user

Users enroll with the AuthNull Wallet app, or keep using Duo or Okta if you bring your own tenant. Enrollment tracked per user — Registered or Pending.

04

Monitor user status

ongoing

The dashboard shows every AD user and service account, their enrollment state, and last authentication event.

05

Set policy

~ 15 min

Define who must MFA — by user, group, OU, source IP, and time. Start with Domain Admins, then widen.

MFA enforced

same day ✓

Policy goes live. Domain authentications are evaluated against it, and when a matching policy requires MFA the user gets a push — held at the DC until they approve.

Helps you evidence
SOC 2 Type IICCPA
FAQ

Active Directory MFA, answered.

  • Yes. AuthNull enforces MFA directly against on-prem Active Directory — no Entra ID, Azure AD, or cloud-sync required. It works on domain logon, RDP, and server access using your existing domain, so you can add MFA without migrating identity to the cloud.

  • Yes, for domain accounts. When a Windows logon (console or RDP) authenticates against AD, including on Remote Desktop session hosts, jump boxes and member servers, the DC Sensor evaluates it against policy. You can require MFA for everyone or scope it to privileged accounts and remote sources only.

  • No. The DC Sensor runs on your domain controllers. There is no agent on workstations or member servers. VPNs and network gear go through the RADIUS Bridge, which runs on a Linux server or Docker.

  • No. AuthNull sits in front of Active Directory and can trigger your existing Duo push. If you already have Duo or Okta enrolled, users keep using the same app — AuthNull just adds the AD enforcement layer.

  • Yes. Policy is scoped by user, group, OU, source IP, and time — so you can require MFA for Domain Admins logging in from outside the network, while leaving standard in-office users untouched.

  • Most teams connect the domain, set a policy, and enforce MFA on a pilot group the same afternoon. Agentless coverage needs no endpoint rollout, and you can widen from a pilot OU to the whole domain at your own pace.

Book a demo

We’ll walk your AD environment with you in 20 minutes and map a rollout.

What happens next
  1. You send the formTwo minutes: who you are and what you want to protect.
  2. We reply within a dayAn engineer emails you to pick a time.
  3. A live 20-minute demoShown against your setup, with time for questions.
What do you want to protect?

By submitting you agree to our Terms and Privacy Policy.