After a user RDP's to a server what group policies does a Admin need to only allow the SID 800 hardware token as the only logon option?

[AndreLocker]

What is the best way to:
1) Only have the RSA SID 800 logon option from the windows logon page whens users RDP into a specific server. What Group policies to do i have to have enabled or disabled?
2) Remove the additional challenge for windows logon credentials after being authenticated by RSA.

In the end what i want to achieve is be able to have a user Remote Desktop into server be challenged by RSA for two factor authentication and then have access to the server as per normal.

Thanks

[HusseinElBaz · Accepted solution]

Hello Andre,

To have the RSA SID 800 only enabled, please follow the below

1) gpedit.msc

2) Go to Administrative Templates -> Classic Administrative Templates (ADM) -> RSA Desktop -> Credential Provider Filter Settings

3) Then change the Setting to 'Enabled' for all the Settings except the one that you want to appear on the logon screen.

4) Then open Windows cmd and type gpupdate /force and press Enter.

5) Log off from the desktop and try to login again.

There is no way to bypass the windows password authentication, but you can use the 'Windows Password Integration" option from RSA.

You can configure RSA Authentication Agent for Microsoft Windows so that the Windows password is integrated into the SecurID logon process. When you configure Authentication Agent in this way, users provide their Windows passwords only during their initial online authentication.

And you can configure that option from the Security Console, click Authentication > Policies > Offline Authentication Policies > Manage Existing. Then enable the Windows Password Integration Option.

So kindly check and advise us back if there is any assistance needed from our side.

Best Regards,

[AndreLocker]

This helped thx!