Isticmaalayaashu waxay isticmaali karaan furayaasha amniga qalabka, oo ay soo saartay shirkadda Iswiidhishka ee Yubico si ay u gasho akoon maxalli ah Windows 10^{(Windows 10)} . Shirkaddu waxay dhawaan soo saartay nuqulkii ugu horreeyay ee xasilloon ee Yubico Login ee codsiga Windows^{(Login for Windows application)} . In this post, waxaan ku tusi doonaa sida loo rakibo oo loo habeeyo YubiKey si loogu isticmaalo Windows 10 PCs.

YubiKey waa qalab xaqiijinta qalabka taageera furaha hal mar ah, sireeynta-guud ee furaha iyo sugida, iyo Universal Factor 2nd (U2F)^{(Universal 2nd Factor (U2F))} iyo FIDO2 borotokool ay soo saartay FIDO Alliance . Waxay u ogolaataa isticmaalayaasha inay si badbaado leh u galaan akoonadooda iyagoo soo saaraya furaha sirta ah ee hal mar ah ama isticmaalaya FIDO-ku-salaysan furaha dadweynaha/lamaanayaasha gaarka ah ee uu soo saaray qalabku. YubiKey waxa kale oo ay ogolaataa in lagu kaydiyo ereyada sirta ah ee static si loogu isticmaalo goobaha aan taageerin ereyada sirta ah ee hal mar ah. Facebook waxay u isticmaashaa YubiKey aqoonsiga shaqaalaha, Google -na waxay u taageertaa shaqaalaha iyo isticmaalayaasha labadaba. Qaar ka mid ah maamulayaasha sirta ah ayaa taageera YubiKey .Yubico sidoo kale waxay soo saartaa Furaha Amniga^{(Security Key)} , qalab la mid ah YubiKey , laakiin diiradda saaraya aqoonsiga furaha dadweynaha.

YubiKey waxay u ogolaataa isticmaalayaasha inay saxeexaan, sireeyaan, oo ay kala saaraan fariimaha iyaga oo aan soo bandhigin furayaasha gaarka ah ee aduunka ka baxsan. Sifadan waxa hore loogu heli jiray isticmaalayaasha Mac iyo Linux .

To configure/set up YubiKey on Windows 10, you’ll need the following:

1. Qalabka USB YubiKey .
2. Yubico Login software ee Windows.
3. YubiKey software software.

Dhammaantood waxa laga heli karaa yubico.com oo ku hoos jira tab Product s. Sidoo kale, waa inaad ogaataa in app-ka YubiKey aanu taageersanayn akoonnada Windows -ka ee ay maamusho Azure Active Directory ( AAD ) ama Hagaha^(Directory) Active (AD) iyo sidoo kale Xisaabaadka Microsoft .

^(YubiKey)Qalabka xaqiijinta qalabka YubiKey

Kahor intaadan rakibin Yubico Login ee software Windows , samee qoraal ku qor magacaaga isticmaale ee Windows iyo eraygaaga sirta ah ee koontada deegaanka. Qofka rakibaya software-ka waa inuu haystaa magaca isticmaalaha iyo furaha Windows ee akoonkiisa. ^(Windows)Kuwaas la'aantood, waxba lama habeyn karo, xisaabtuna waa mid aan la heli karin. Dabeecada caadiga ah ee bixiyaha aqoonsiga Windows waa inuu xasuusto galitaankaagii u dambeeyay, markaa ma aha inaad ku qorto magaca isticmaalaha.

Sababtan awgeed, dad badan ayaa laga yaabaa inaysan xasuusan magaca isticmaalaha. Si kastaba ha noqotee, markaad rakibto qalabka oo aad dib u bilowdo, bixiyaha cusub ee Yubico ayaa la raray, si labada admins iyo isticmaalayaasha dhamaadka ay dhab ahaantii ku qoraan magaca isticmaalaha. Sababahan dartood, ma aha maamulaha oo kaliya, laakiin sidoo kale qof kasta oo akoonkiisa lagu habeynayo Yubico Login for Windows waa inuu hubiyo inay geli karaan iyaga oo isticmaalaya magaca isticmaale ee Windows iyo erayga sirta ah ee koontada maxalliga ah KA HOR inta maamuluhu rakibin aaladda oo uu dejiyo dhamaadka - xisaabaadka isticmaalayaasha.

Waxa kale oo lagama maarmaan ah in la ogaado, marka Yubico Login ee Windows la habeeyey, waxaa jira:

• Ma jiro Tilmaamaha Furaha Windows
• Ma jiro hab dib loogu dejiyo furaha sirta ah
• Maya Remember Previous User/Login shaqada.

Intaa waxaa dheer, galitaanka tooska ah ee Windows kuma habboona Yubico Login ee Windows . Haddii isticmaale koontada loo dejiyay gelitaan toos ah uusan dib u xasuusan erayga sirta ah ee asalka ahaa marka Yubico Login ee qaabeynta Windows uu hirgalo , koontada lama geli karo. Si badheedh ah wax uga qabto^(Address) arrintan adigoo:

• In dadka isticmaala ay dejiyaan furaha sirta ah ka hor inta aysan joojin soo gelista tooska ah.
• Dhammaan isticmaalayaashu ha xaqiijiyaan inay ku geli karaan akoonadooda iyaga oo wata magaca isticmaalaha iyo erayga sirta ah ee cusub ka hor intaadan isticmaalin Yubico Login for Windows si aad u habayso akoonadooda.

Oggolaanshaha maamulaha ayaa loo baahan yahay si loo rakibo software-ka.

Rakibaadda YubiKey

Marka hore, xaqiiji magacaaga isticmaale Marka aad ku rakibto Yubico ^(PowerShell)Login ^{(Command Prompt)}for^{(Yubico Login)} Windows oo^(Windows) dib loo bilaabo , waxaad u baahan doontaa inaad^(Start) geliso tan marka lagu daro eraygaaga sirta ah si aad u gasho.

whoami

U^(Take) fiirso wax soo saarka buuxa, kaas oo ah qaabka DESKTOP-1JJQRDF\jdoe , halkaasoo  jdoe  uu yahay magaca isticmaalaha.

1. Halkan^(Download) kala soo deg Yubico Login^{(Yubico Login)} ee software Windows ka^(here) .
2. Ku socodsii rakibaha adiga oo laba jeer gujinaya soo dejinta.
3. Aqbal heshiiska shatiga isticmaalaha.
4. Wizard-ka rakibaadda, sheeg meesha galka aad ku socoto ama aqbal meesha caadiga ah.
5. Dib u bilow mishiinka lagu rakibay software-ka. Dib u bilaabashada ka dib, bixiyaha aqoonsiga Yubico ayaa soo bandhigaya shaashadda soo gelida ee u kicisa YubiKey^(YubiKey) .

Sababtoo ah YubiKey weli lama bixin, waa inaad beddeshaa isticmaalaha oo aad gelisaa ereyga sirta ah ee koontada Windows -ka ee deegaankaaga , laakiin sidoo kale magacaaga isticmaale ee xisaabtaas. Haddii loo baahdo, waxaa laga yaabaa inaad u bedesho Koontada Microsoft una beddelato Koontada Maxalliga ah .

Kadib markaad gasho, ka raadi "Configuration Login" oo leh astaanta cagaaran. (Shayga runtii lagu calaamadiyay Yubico Login ee Windows waa rakibaha kaliya, maaha codsiga.)

Habaynta YubiKey

Oggolaanshaha maamulaha^{(Administrator)} ayaa loo baahan yahay si loo habeeyo software-ka.
Kaliya akoonnada la taageero ayaa lagu habeyn karaa Yubico Login ee Windows . Haddii aad bilowdo saaxir qaabeynta, oo koontada aad raadineyso aan la soo bandhigin, lama taageero oo sidaas darteed looma heli karo qaabeynta.

Inta lagu jiro habka qaabeynta, waxyaabaha soo socda ayaa loo baahan doonaa;

• Furayaasha Aasaasiga ah iyo Kaabta^{(Primary and Backup Keys)} : Isticmaal YubiKey ka duwan diiwaangelin kasta. Haddii aad configuring furayaasha gurmad, user kasta waa in uu leeyahay hal YubiKey ee aasaasiga ah iyo kan labaad ee furaha gurmad.
• Koodhka Soo kabashada^{(Recovery Code)} : Koodhka soo kabashada waa habka ugu dambeeya ee lagu xaqiijiyo isticmaalaha haddii dhammaan YubiKeys ay lumeen. Koodhadhka soo kabashada^(Recovery) waxaa lagu meelayn karaa isticmaalayaasha aad sheegtay; si kastaba ha ahaatee, koodhka soo kabashada ayaa la isticmaali karaa oo kaliya haddii magaca isticmaalaha iyo erayga sirta ah ee xisaabta sidoo kale la heli karo. Ikhtiyaarka lagu abuurayo koodka soo kabashada ayaa la soo bandhigay inta lagu jiro habka qaabeynta.

Talaabada 1: Gudaha menu Start ee Windows , dooro Yubico > Qaabaynta Soo gal^{(Login Configuration)} .

Talaabada 2: Wadahadalka Xakamaynta Koontada Isticmaalaha^{(User Account Control)} ayaa soo muuqda. Haddii aad tan ka waddo akoon aan Maamule ahayn, waxaa lagu weydiin doonaa aqoonsiga maamulaha deegaanka. Bogga Soo-dhaweyntu waxa uu soo bandhigayaa saaxir bixinta Isku xidhka Soo galitaanka Yubico^{(Yubico Login Configuration)} :

Tallaabada 3: Guji Next . Bogga ugu talagalka ah ee Isku xidhka Login Windows Yubico ^{(Yubico Windows Login Configuration)}ayaa^(Default) soo muuqda.

Talaabada 4: Shayada la isku habayn karo waa:

Afyare^(Slots) : Dooro booska halka lagu kaydin doono sirta ka jawaab celinta. Dhammaan YubiKeys-ka aan la habeynin waxay ku yimaadaan horay loo sii raray iyagoo wata aqoonsiga booska 1, markaa haddii aad isticmaalayso Yubico Login for Windows si aad u habayso YubiKeys horay loogu isticmaalay gelitaanka akoonnada kale, ha ku beddelin booska 1.

Challenge/Response Secret : Shaygani waxa uu awood kuu siinayaa in aad qeexdo sida sirta loo habayn doono iyo halka lagu kaydin doono. Doorashadu waa:

• Isticmaal sirta jirta haddii la habeeyey – dhali haddaan la habeynin^{(Use existing secret if configured – generate if not configured)} : Sirta jirta ee furaha waxaa loo isticmaali doonaa booska la cayimay. Haddii qalabku aanu lahayn sir jira, habka bixinta ayaa dhalin doona sir cusub.
• Samee sir cusub oo random ah, xitaa haddii sirta hadda la habeeyay^{(Generate new, random secret, even if a secret is currently configured)} : Siro cusub ayaa la soo saari doonaa oo lagu barnaamijayn doonaa booska, iyadoo lagu beddelayo sir kasta oo hore loo habeeyey.
• Gacanta ku geli sirta sirta ah^{(Manually input secret)} :  Isticmaalayaasha horumarsan^{(For advanced users)} : Inta lagu jiro habka bixinta, codsigu wuxuu kugu dhiirigelin doonaa inaad gacanta ku geliso sirta HMAC-SHA1 (20 bytes - 40 xaraf hex-encoded).

Samee Koodhka Soo kabashada^{(Generate Recovery Code)} : Isticmaale kasta oo la bixiyo, kood soo kabashada cusub ayaa la soo saari doonaa. Koodhkan soo kabashada ayaa awood u siinaya isticmaalaha ugu dambeeya inuu galo nidaamka haddii ay lumiyeen YubiKey.
Fiiro gaar ah: Haddii aad dooratid inaad kaydiso koodka soo kabashada markaad siinayso isticmaale furaha labaad, kood kasta oo soo kabasho hore wuxuu noqonayaa mid aan sax ahayn, oo kaliya koodhka soo kabashada cusub ayaa shaqayn doona.

U samee Aaladaha kaabta ee Isticmaale Kasta^{(Create Backup Device for Each User)} : Isticmaal doorashadan si aad nidaamka bixinta u diiwaan geliso laba fure isticmaale kasta, YubiKey aasaasiga ah iyo kaydka YubiKey . Haddii aadan rabin inaad siiso koodka soo kabashada isticmaaleyaashaada, waa dhaqan wanaagsan in la siiyo isticmaale kasta YubiKey gurmad ah . Macluumaad intaas ka badan, tixraac qaybta Koowaad^(Primary) iyo kaabta^{(Backup Keys)}  ee kore.

Tallaabada 5: Guji Next , si aad u dooratid isticmaalayaasha si ay u bixiyaan. Xulo Xisaabaadka Isticmaalaha^{(Select User Accounts)} bogga (Haddii aysan jirin xisaabaadka isticmaale maxalli ah oo ay taageerto Yubico Login for Windows , liisku wuu madhnaan doonaa) ayaa soo muuqda.

Talaabada 6: Dooro xisaabaadka isticmaalaha in la bixiyo inta lagu guda jiro hadda socda ee Yubico Login for Windows adiga oo dooranaya sanduuqa ku xiga username, ka dibna riix Next . Bogga Isticmaalaha Isku Habaynta^{(Configuring User)} ayaa soo muuqda.

Tallaabada 7: Magaca isticmaalaha ee lagu muujiyay goobta Isticmaalaha Isku-habaynta^{(Configuring User)} ee kor ku xusan waa isticmaalaha kan YubiKey hadda loo habeynayo. Sida username kasta oo la soo bandhigay, geedi socodka ku dhiirigelinayaan in aad geliso YubiKey ah si ay u diiwaan user in.

Talaabada 8: Sug for Device^{(Wait for Device)} bogga waxaa lagu muujiyay halka YubiKey la geliyey la ogaanayo iyo ka hor inta aan la diiwaan gelin user username waa in Configuring User garoonka sare ee bogga. Haddii aad dooratay U samee Aaladda kaabta ee Isticmaale kasta^{(Create Backup Device for Each User)} bogga Defaults , Configuring User field ayaa sidoo kale muujin doona midka YubiKeys ee la diiwaan geliyo, Primary ama Backup .

Tallaabada 9: Haddii aad habaysay habka bixinta si aad u isticmaasho sir gacanta lagu cayimay, goobta sirta 40-god ee hex-ga ayaa la soo bandhigay. Geli sirta oo guji Next .

Talaabada 10: Bogga Aaladda Programming^{(Programming Device)} -ka waxa uu soo bandhigayaa horumarka barnaamijka YubiKey kasta . Bogga Xaqiijinta Qalabka^{(Device Confirmation)} ee hoos ku qoran wuxuu muujinayaa faahfaahinta YubiKey ee lagu ogaaday habka bixinta, oo ay ku jiraan lambarka taxan ee aaladda (haddii la heli karo) iyo heerka qaabeynta ee hal-wakhti-Password^{(One-Time Password)} ( OTP ). Haddii ay jiraan khilaafyo u dhexeeya waxa aad dejisay sida khaladaadka iyo waxa suurtogalka ah ee la ogaaday YubiKey , calaamad digniin ah ayaa la soo bandhigay. Haddii wax walba ay wanaagsan yihiin in la tago, calaamad sax ah ayaa la tusi doonaa. Haddii xariiqda xaaladdu muujiso calaamad khalad ah, khaladku waa la sifeynayaa, tilmaamaha hagaajintiisa ayaa lagu soo bandhigay shaashadda.

Tallaabada 11: Marka barnaamijka la dhammeeyo koontada isticmaalaha, xisaabtaas lama geli karo iyada oo aan la helin YubiKey u dhigma . Waxaa lagugu dhiirigelinayaa inaad ka saarto YubiKey oo hadda la habeeyay, iyo habka bixinta si toos ah u socdaa koontada isticmaale ee soo socota / isku darka YubiKey .

Tallaabada 12: Ka dib oo dhan, YubiKeys ee koontada isticmaale ee la cayimay ayaa la siiyay:

• Haddii Generate Code-ka soo kabashada^{(Generate Recovery Code)}  lagu doortay bogga Defaults , bogga Code-ka soo kabashada^{(Recovery Code)} ayaa la soo bandhigay.
• Haddii  Aasaaska Koodhka Soo-kabashada^{(Generate Recovery Code)}  aan la dooran, habka bixinta ayaa si toos ah u socon doonta koontada isticmaalaha xiga.
• Habka bixinta wuxuu u guuraa  Dhamaystiran^(Finished)  ka dib markii la sameeyo akoonkii isticmaale ee ugu dambeeyay.

Koodhka soo kabashada waa xadhig dheer. (Si loo baabi'iyo dhibaatooyinka uu keeno isticmaalaha ugu dambeeya ee ku khaldaaya nambarka 1 ee xarafka yar ee L iyo 0 ee xarafka O, koodhka soo kabashada wuxuu ku qoran yahay Base32 , kaas oo daaweeya xarfaha alfanumeric ee u eg inay isku mid yihiin.)

Bogga Koodhka Soo kabashada^{(Recovery Code)} ayaa la soo bandhigay ka dib markii dhammaan YubiKeys ee xisaabta isticmaale ee cayiman la habeeyey.

Talaabada 13: Bogga Koodhka Soo-kabashada^{(Recovery Code)} , samee oo deji koodka soo kabashada isticmaalaha la doortay. Marka tan la sameeyo, koobi^(Copy)  iyo  Badbaadinta^(Save) badhamada dhanka midig ee goobta code-ka soo kabashada ayaa diyaar ah.

Talaabada 14: Koobi koodhka soo kabashada oo ka badbaadi in lala wadaago isticmaalaha oo ilaali haddii isticmaaluhu lumiyo.

Xusuusin^(Note) : Hubi inaad kaydiso koodhka soo kabashada wakhtigan hawsha. Markaad u sii gudubto shaashadda xigta, suurtogal maaha inaad soo celiso koodka.

Talaabada 15: Si aad ugu guurto koontada isticmaale ee soo socota bogga Xulashada Isticmaalayaasha^{(Select Users)} , dhagsii Next . Markaad habayso isticmaaleha ugu dambeeya, habka bixinta ayaa soo bandhigaya bogga Dhammaaday^(Finished) .

Tallaabada 16: Sii isticmaale kasta koodka soo kabashada. Isticmaalayaasha ugu dambeeya waa in ay kaydiyaan koodka soo kabashada meel ammaan ah oo la heli karo marka aysan geli karin.

YubiKey Isticmaalka Khibradda

Marka koontada isticmaalaha maxaliga ah loo habeeyey inay u baahato YubiKey , isticmaaluhu waxa xaqiijiya Bixiyaha Aqoonsiga Yubico^{(Yubico Credential Provider)} halkii uu ka ahaan lahaa Bixiyaha Aqoonsiga Windows ee caadiga ah . Isticmaalaha waxa lagu dhiiri galinayaa in uu geliyo YubiKey . Kadibna shaashadda Login Yubico^{(Yubico Login)} ayaa la soo bandhigay. Isticmaaluhu wuxuu galayaa isticmaalkooda iyo erayga sirta ah.

Fiiro gaar^(Note) ah : Looma baahna in la riixo badhanka qalabka USB YubiKey^{(YubiKey USB)} si aad u gasho. Mararka qaarkood, riixitaanka badhanka ayaa sababta login inuu ku guuldareysto.

Marka dhamaadka-user galo in, waa in ay geliso YubiKey saxda ah dekedda USB ah oo ku saabsan nidaamka ay. Haddii dhamaadka-user galo ay username iyo erayga sirta ah oo aan gelin YubiKey saxda ah , xaqiijinta fashilmi doonaa, iyo user waxaa lagu soo bandhigi doonaa fariin qalad ah.

Haddii xisaabta user dhamaadka ah loo habeeyey Yubico Login for Windows , iyo haddii code a soo kabashada la soo saaray, iyo user a lumin YubiKey (-yada), waxay isticmaali karaan code soo kabashada si loo xaqiijiyo. Isticmaalaha ugu dambeeya wuxuu ku furayaa kombuyuutarkooda magaciisa isticmaale, koodhka soo kabashada, iyo erayga sirta ah.

Ilaa YubiKey cusub la habeeyo, isticmaala dhamaadka-user waa in ay galaan code kabashada mar kasta oo ay galaan.

Haddii Yubico Login ee Windows uusan ogaanin in YubiKey la geliyey, waxay u badan tahay inay sabab u tahay furaha oo aan lahayn habka OTP -ga, ama aadan gelin YubiKey , laakiin beddelkeeda Key Security^{(Security Key)} , kaas oo aan ku habboonayn codsigan. Isticmaal arjiga Maareeyaha YubiKey^{(YubiKey Manager)}  si aad u hubiso in dhammaan YubiKeys ee la bixinayo ay leeyihiin interface -ka OTP .

Muhiim^(Important) : Hababka galitaanka beddelka ah ee ay taageerto Windows ma saameyn doonto. Sidaa darteed, waa inaad xaddidaa hababka gelitaanka gudaha iyo fog ee dheeraadka ah ee xisaabaadka isticmaale ee aad ku ilaalinayso Yubico Login for Windows si aad u hubiso inaadan uga tagin wax 'albaab danbe' ah.

Haddii aad isku daydo YubiKey, noo sheeg khibradaada qaybta faallooyinka ee hoose.^{(If you try out YubiKey, let us know your experience in the comments section below.)}

Configure & use YubiKey Secure Login for Local Account in Windows 10

Users can use hardware security keys, manufactured bу Swedish сompany Yubico to log into a Local account on Windows 10. The company recently released the first stable version of the Yubico Login for Windows application. In this post, we will show you how to install and configure YubiKey for use on Windows 10 PCs.

YubiKey is a hardware authentication device that supports one-time passwords, public-key encryption and authentication, and the Universal 2nd Factor (U2F) and FIDO2 protocols developed by the FIDO Alliance. It allows users to securely log in to their accounts by emitting one-time passwords or using a FIDO-based public/private key pair generated by the device. YubiKey also allows for storing static passwords for use at sites that do not support one-time passwords. Facebook uses YubiKey for employee credentials, and Google supports it for both employees and users. Some password managers support YubiKey. Yubico also manufactures the Security Key, a device similar to the YubiKey, but focused on public-key authentication.

YubiKey allows users to sign, encrypt, and decrypt messages without exposing the private keys to the outside world. This feature was previously available only for Mac & Linux users.

To configure/set up YubiKey on Windows 10, you’ll need the following:

1. A YubiKey USB hardware .
2. Yubico Login software for Windows.
3. YubiKey Manager software.

All of them are available on yubico.com under their Products tab. Also, you should note that the YubiKey app does not support local Windows accounts managed by Azure Active Directory (AAD) or Active Directory (AD) as well as Microsoft Accounts.

YubiKey hardware authentication device

Before installing the Yubico Login for Windows software, make a note of your Windows username and password for the local account. The person who installs the software must have the Windows username and password for their account. Without these, nothing can be configured, and the account is inaccessible. The default behavior of the Windows credential provider is to remember your last login, so you do not have to type in the username.

For this reason, many people may not remember the username. However, once you install the tool and reboot, the new Yubico credential provider is loaded, so that both admins and end-users have actually to type in the username. For these reasons, not only the admin but also everybody whose account is to be configured via Yubico Login for Windows should check to ensure that they can log in using the Windows username and password for their local account BEFORE the admin installs the tool and configures end-users’ accounts.

It’s also imperative to note that, once Yubico Login for Windows has been configured, there is:

• No Windows Password Hint
• No way to reset passwords
• No Remember Previous User/Login function.

Additionally, Windows automatic login is not compatible with Yubico Login for Windows. If a user whose account was set up for automatic login no longer remembers their original password when the Yubico Login for Windows configuration takes effect, the account can no longer be accessed. Address this issue preemptively by:

• Having users set new passwords before disabling automatic login.
• Have all users verify they can access their accounts with username and their new password before you use Yubico Login for Windows to configure their accounts.

Administrator permissions are required to install the software.

YubiKey Installation

First, verify your username. Once you have installed Yubico Login for Windows and rebooted, you will need to enter this in addition to your password to log in. To do this, open Command Prompt or PowerShell from the Start menu and run the command below

whoami

Take note of the full output, which should be in the form DESKTOP-1JJQRDF\jdoe, where jdoe is the username.

1. Download the Yubico Login for Windows software from here.
2. Run the installer by double-clicking on the download.
3. Accept the end-user license agreement.
4. In the installation wizard, specify the destination folder location or accept the default location.
5. Restart the machine on which the software has been installed. After the restart, the Yubico credential provider presents the login screen that prompts for the YubiKey.

Because the YubiKey has not yet been provisioned, you must switch user and enter not only the password for your local Windows account, but also your username for that account. If necessary, you may have to change Microsoft Account to Local Account.

After you have logged in, search for “Login Configuration” with the green icon. (The item actually labeled Yubico Login for Windows is just the installer, not the application.)

YubiKey Configuration

Administrator permissions are required to configure the software.
Only accounts that are supported can be configured for Yubico Login for Windows. If you launch the configuration wizard, and the account you are looking for is not displayed, it is not supported and therefore not available for configuration.

During the configuration process, the following will be required;

• Primary and Backup Keys: Use a different YubiKey for each registration. If you are configuring backup keys, each user should have one YubiKey for the primary and a second one for the backup key.
• Recovery Code: A recovery code is a last-resort mechanism to authenticate a user if all YubiKeys have been lost. Recovery codes can be assigned to the users you specify; however, the recovery code is only usable if the username and password for the account are also available. The option to generate a recovery code is presented during the configuration process.

Step 1: In the Windows Start menu, select Yubico > Login Configuration.

Step 2: The User Account Control dialog appears. If you are running this from a non-Administrator account, you will be prompted for local administrator credentials. The Welcome page introduces the Yubico Login Configuration provisioning wizard:

Step 3: Click Next. The Default page of Yubico Windows Login Configuration appears.

Step 4: The configurable items are:

Slots: Select the slot where the challenge-response secret will be stored. All YubiKeys that have not been customized come pre-loaded with a credential in slot 1, so if you are using Yubico Login for Windows to configure YubiKeys that are already being used for logging into other accounts, do not overwrite slot 1.

Challenge/Response Secret: This item enables you to specify how the secret will be configured and where it will be stored. The options are:

• Use existing secret if configured – generate if not configured: The key’s existing secret will be used in the specified slot. If the device has no existing secret, the provisioning process will generate a new secret.
• Generate new, random secret, even if a secret is currently configured: A new secret will be generated and programmed to the slot, overwriting any previously configured secret.
• Manually input secret: For advanced users: During the provisioning process, the application will prompt you to input manually an HMAC-SHA1 secret (20 bytes – 40 characters hex-encoded).

Generate Recovery Code: For each user provisioned, a new recovery code will be generated. This recovery code enables the end-user to log in to the system if they have lost their YubiKey.
Note: If you select to save a recovery code while provisioning a user for a second key, any previous recovery code becomes invalid, and only the new recovery code will work.

Create Backup Device for Each User: Use this option to have the provisioning process register two keys for each user, a primary YubiKey and a backup YubiKey. If you do not want to provide recovery codes to your users, it is good practice to give each user a backup YubiKey. For more information, refer to the Primary and Backup Keys section above.

Step 5: Click Next, to select the user(s) to provision. The Select User Accounts page (If there are no local user accounts supported by Yubico Login for Windows, the list will be empty) appears.

Step 6: Select the user accounts to be provisioned during the current run of the Yubico Login for Windows by selecting the checkbox next to the username, and then click Next. The Configuring User page appears.

Step 7: The username shown in the Configuring User field shown above is the user for whom a YubiKey is currently being configured. As each username is displayed, the process prompts you to insert a YubiKey to register for that user.

Step 8: The Wait for Device page is shown while an inserted YubiKey is being detected and before it is registered for the user whose username is in the Configuring User field at the top of the page. If you have selected Create Backup Device for Each User in the Defaults page, the Configuring User field will also display which of the YubiKeys is being registered, Primary or Backup.

Step 9: If you have configured the provisioning process to use a manually specified secret, the field for the 40 hex-digit secrets is displayed. Enter the secret and click Next.

Step 10: The Programming Device page displays the progress of programming each YubiKey.  The Device Confirmation page shown below displays the details of the YubiKey detected by the provisioning process, including the device serial number (if available) and the configuration status of each One-Time Password (OTP) slot. If there are conflicts between what you have set as defaults and what is possible with the detected YubiKey, a warning symbol is displayed. If everything is good to go, a check mark will be shown. If the status line shows an error icon, the error is described, and instructions for fixing it are displayed on the screen.

Step 11: Once programming is complete for a user account, that account can no longer be accessed without the corresponding YubiKey. You are prompted to remove the YubiKey just configured, and the provisioning process automatically proceeds to the next user account/YubiKey combination.

Step 12: After all, the YubiKeys for the specified user account have been provisioned:

• If the Generate Recovery Code was selected on the Defaults page, the Recovery Code page is displayed.
• If Generate Recovery Code was not selected, the provisioning process would automatically continue to the next user account.
• The provisioning process moves to Finished after the last user account is done.

The recovery code is a long string. (To eliminate problems caused by the end-user mistaking the numeral 1 for lowercase letter L and 0 for the letter O, the recovery code is encoded in Base32, which treats alphanumeric characters that look similar as if they were the same.)

The Recovery Code page is displayed after all the YubiKeys for the specified user account has been configured.

Step 13: On the Recovery Code page, generate and set a recovery code for the selected user. Once this has been done, the Copy and Save buttons to the right of the recovery code field become available.

Step 14: Copy the recovery code and save it from being shared with the user and keep it in case the user loses it.

Note: Be sure to save the recovery code at this point in the process. Once you proceed to the next screen, it is not possible to retrieve the code.

Step 15: To move to the next user account from the Select Users page, click Next. When you have configured the last user, the provisioning process displays the Finished page.

Step 16: Give each user their recovery code. End-users should save their recovery code to a safe location accessible when they cannot log in.

YubiKey User Experience

When the local user account has been configured to require a YubiKey, the user is authenticated by the Yubico Credential Provider instead of the default Windows Credential Provider. The user is prompted to insert their YubiKey. Then the Yubico Login screen is presented. The user enters their username and password.

Note: It is not necessary to press the button on the YubiKey USB hardware to log in. In some instances, pressing the button causes the login to fail.

When the end-user logs in, they must insert the correct YubiKey into a USB port on their system. If the end-user enters their username and password without inserting the correct YubiKey, authentication will fail, and the user will be presented with an error message.

If an end user’s account is configured for Yubico Login for Windows, and if a recovery code was generated, and a user loses their YubiKey(s), they can use their recovery code to authenticate. The end-user unlocks their computer with their username, recovery code, and password.

Until a new YubiKey is configured, the end-user must enter the recovery code each time they log in.

If Yubico Login for Windows does not detect that a YubiKey has been inserted, it is likely due to the key not having OTP mode enabled, or you are not inserting a YubiKey, but instead a Security Key, which is not compatible with this application. Use the YubiKey Manager application to ensure that all the YubiKeys to be provisioned have the OTP interface enabled.

Important: Alternative sign-in methods supported by Windows will not be affected. You must, therefore, restrict additional local and remote login methods for the user accounts you are protecting with Yubico Login for Windows to ensure you have not left open any ‘back doors.’

If you try out YubiKey, let us know your experience in the comments section below.

Related posts

• Arag Su'aalaha Amniga iyo Jawaabaha Koontada Maxaliga ah ee gudaha Windows 10

• Sida loo rakibo Windows 11 & Windows 10 on USB Drive (Windows To Go)

• 3 siyaabood oo aad Windows 10 PC kaaga uga bootin karto USB-ga

• Bedel Ikhtiyaarka Isticmaalaha oo ka maqan Windows 10 shaashadda soo galitaanka

• Dib u deji erayga sirta ah ee Koontada Maxaliga ah Windows 10 addoo isticmaalaya Warbaahinta Rakibaadda

• Sida loo shido oo loo damiyo kaydiyaha batteriga gudaha Windows 10

• Sida loo beddelo aaladaha dhawaaqa caadiga ah ee gudaha Windows 10 (dib u ciyaar iyo duubid)

• Daar ama dami Soo gal ammaan ah Windows 10

• Sida loo isticmaalo Continuum on Windows 10 Mobile la'aantii Microsoft Display Dock

• Ka soo dir faylasha taleefanka casriga ah ee Android Windows 10, oo wata Bluetooth

• Ku xidh teleefan Android ah Windows 10 Laptop ama PC adigoo isticmaalaya Bluetooth-

• Taleefannada dhegaha ee Bluetooth-ka ugu fiican Windows 10 PC

• Sida telefoonkaaga looga saaro Windows 10

• Sida loo doorto GPU-ga caadiga ah ee ciyaaraha ama abka gudaha Windows 10

• Sida loogu xidho Windows 10 PC a Windows 10 mobilada casriga ah, adoo isticmaalaya Bluetooth

• Sida toos loogu xidho Windows 10 casrigaaga

• Sida loo galo BIOS gudaha Windows 10

• Sida loo isticmaalo Xarunta Dhaqdhaqaaqa Windows gudaha Windows 10 -

• Sideen ugu xidhi karaa iPhone-kayga kumbuyuutarka Windows 10?

• Waa maxay faylka ICM? Sida loo isticmaalo in lagu rakibo profile midabka, gudaha Windows 10?