UserLock by IS Decisions is a popular way to add MFA to Active Directory environments. Until now, its hardware-token support was limited to HOTP. Starting with UserLock 13.1, it also supports the FIDO2 protocol, and any FIDO2 security key, including Token2 keys, can be enrolled as an MFA method.
From HOTP to FIDO2
With HOTP, the token and the server share the same secret seed, and the generated codes can still be phished. With FIDO2, the private key never leaves the device: sign-in is a cryptographic challenge-response, protected by a PIN and a touch. There is no code to type and nothing reusable to steal.
HOTP tokens still work in UserLock as the USB Token option. FIDO2 keys appear as a separate Security Key option, so you can migrate gradually.
Biometric keys and one key for everything
Because UserLock now uses standard FIDO2, biometric keys work too. Users confirm sign-in with their fingerprint instead of typing a PIN each time, so they get phishing resistance without losing convenience.
And since the protocol is standard FIDO2, the same key is not locked to UserLock. It can also hold passkeys for Microsoft Entra ID, Google, GitHub and other services. Most Token2 keys store up to 300 passkeys, so one key covers Windows logon and the user's online accounts.
Where the key can be used
- Windows logon, local or over Remote Desktop (mstsc.exe or the Windows App)
- UAC elevation prompts
- RemoteApp and RD Gateway connections
- Web and cloud applications protected by UserLock
- Offline logon, on computers where the user has already signed in online with the key (PIN always required)
- Both USB and NFC keys are supported
Tips for deployment
- Enroll a backup key: UserLock allows two security keys per user
- Set a FIDO2 PIN: some keys enforce PIN complexity rules, so let users know in advance
- Sign in online once on each computer before relying on offline logon
- Share the enrollment guide with end users: UserLock FIDO2 guide
Need help choosing keys for a UserLock deployment (standard or biometric), or moving from HOTP to FIDO2? Contact us.
UserLock compatible keys (FIDO2)
For UserLock versions earlier than 13.1, use keys with HOTP support.
UserLock compatible keys (HOTP)