Installing Trusona for Windows Passwordless

This guide details the steps required to install and configure Trusona's Active Directory Agent and Credential Provider.

By Nikolas Mangu-Thitu
Updated Aug 13, 2020

• 1. Install Active Directory Certificate Services (ADCS)
  • 1.1. ADCS installation Steps
  • 1.2. ADCS installation walk through
• 2. Configure Active Directory Certificate Services
  • 2.1. ADCS configuration steps
  • 2.2. ADCS configuration walk through
• 3. Configure Active Directory Certificate Enrollment Settings
  • 3.1. ADCS enrollment steps
  • 3.2. ADCS enrollment walk through
• 4. Configure Active Directory Server Authentication Enrollment Settings
  • 4.1. AD authentication enrollment steps
  • 4.2. AD authentication enrollment walk through
• 5. Server KDC Enrollment
  • 5.1. Server KDC enrollment steps
  • 5.2. Server KDC enrollment walk through
• 6. Agent Service Installation
  • 6.1. Agent install steps
  • 6.2. Agent install walk through
  • 6.3. Agent Status Validation
• 7. Optional: Disabling password-based authentication
  • 7.1. Disabling passwords walk through
• 8. Credential Provider Installation
  • 8.1. Manual Installation
  • 8.2. CLI Installation
  • 8.3. Automated Install using Active Directory Group Policy
    • 8.3.1. Prerequisite: Create the policy central store for your domain
    • 8.3.2. Prerequisite: Install and configure the Wait For Network Policy
    • 8.3.3. Install and configure the Trusona Group Policy Template
    • 8.3.4. Deploying the Trusona Credential Provider
    • 8.3.5. Assign the GPO

1. Install Active Directory Certificate Services (ADCS)

1.1. ADCS installation Steps

1. Login as an Enterprise Administrator
2. Open the Server Manager on the Active Directory instance to be used
3. On the right hand side, click on Manage and select Add Roles and Features
4. Next, for installation type, select Role-based or feature-based installation
5. Select the target server from the provided selection
6. Check off Active Directory Certificate Services from the list of available Server Roles
7. Click on Add Features on the screen that pops up
8. Accept the pre-selected values on the features list
9. Click on Next
10. In the list of Role Services, check off Certification Authority and click on Next
11. Check off the option to restart the destination server automatically if required
12. Finally, review previously made selections then click on Install
13. Installation should complete successfully in a short while. When done click on Close

1.2. ADCS installation walk through

Open the Server Manager on the Active Directory instance to be used.

Server manager

On the right hand side, click on Manage and select Add Roles and Features:

Add Roles and Features

Next, for installation type, select Role-based or feature-based installation:

Role-based or feature-based installation

Select the target server from the provided selection:

server pool selection

Check off Active Directory Certificate Services from the list of available Server Roles:

Active Directory Certificate Services

Click on Add Features on the screen that pops up:

Add Features

Accept the pre-selected values on the features list:

Select Features

Click on Next

In the list of Role Services, check off Certification Authority and click on Next

Role Services

Check off the option to restart the destination server automatically if required:

Restart if required

Finally, review previously made selections then click on Install

Installation should complete successfully in a short while. When done click on Close

2. Configure Active Directory Certificate Services

2.1. ADCS configuration steps

1. Inside the Server Manager, click on Manage on the top right menu, and select Configure Active Directory Certificate Services...
2. Provide appropriate credentials as recommended in the details, then click on Next
3. Select Certification Authority, then click on Next
4. Select Enterprise CA, then click on Next
5. Select Root CA, then click on Next
6. For a new installation, select create a new private key, then click on Next. If this is not a new installation, provide a existing private key
7. Keep the default pre-selected values on this screen, then click on Next
8. Make the appropriate changes on this screen by providing correct values for all three fields, then click on Next
9. Specify an appropriate validity period, then click on Next
10. Keep the default values, then click on Next
11. Confirm the previously select values. If you want, you may go back and make changes as necessary, then click on Configure
12. Configuration should complete in a short while. After it is done, click on Close

2.2. ADCS configuration walk through

Inside the Server Manager, click on Manage on the top right menu, and select Configure Active Directory Certificate Services...

Provide appropriate credentials as recommended in the details, then click on Next

Select Certification Authority, then click on Next

Select Enterprise CA, then click on Next

Select Root CA, then click on Next

For a new installation, select create a new private key, then click on Next. If this is not a new installation, provide a existing private key:

Keep the default pre-selected values on this screen, then click on Next

Make the appropriate changes on this screen by providing correct values for all three fields, then click on Next

Specify an appropriate validity period, then click on Next

Keep the default values, then click on Next

Confirm the previously select values. If you want, you may go back and make changes as necessary, then click on Configure

Configuration should complete in a short while. After it is done, click on Close

3. Configure Active Directory Certificate Enrollment Settings

3.1. ADCS enrollment steps

1. From the Start Menu, click on Windows Administrative Tools
2. Click on Certification Authority
3. Right click on Certificate Template and click on Manage
4. Right click on Smartcard User and click on Duplicate Template
5. By default, the initial tab will be Compatibility. Do not make any changes on this tab.
6. On the General tab, specify the template display name as exactly TrusonaUserEnrollment
7. On the Request Handling tab, at the purpose drop drown, select Signature and smartcard logon
8. On the Cryptography tab, specify a minimum key size of 2048.
9. Additionally, select the Requests must use one of the following providers radio button and check off Microsoft Base Smart Card Crypto Provider
10. On the Subject Name tab, uncheck boxes all except for User principal name (UPN)
11. On the Security tab, select Authenticated Users in the upper section, then check off Read and Enroll permissions in the lower section
12. Click on Apply and then OK
13. Right click on Certificate Templates one more time.
14. Go to New and click on Certificate Template to Issue
15. In the list of templates, select the TrusonaUserEnrollment template that was just created and click on OK

3.2. ADCS enrollment walk through

From the Start Menu, click on Windows Administrative Tools

Click on Certification Authority

Right click on Certificate Template and click on Manage

Right click on Smartcard User and click on Duplicate Template

By default, the initial tab will be Compatibility. Do not make any changes on this tab.

On the General tab, specify the template display name as exactly TrusonaUserEnrollment

On the Request Handling tab, at the purpose drop drown, select Signature and smartcard logon

On the Cryptography tab, specify a minimum key size of 2048.

Additionally, select the Requests must use one of the following providers radio button and check off Microsoft Base Smart Card Crypto Provider

On the Subject Name tab, uncheck boxes all except for User principal name (UPN)

On the Security tab, select Authenticated Users in the upper section, then check off Read and Enroll permissions in the lower section

Click on Apply and then OK

Right click on Certificate Templates one more time.

Go to New and click on Certificate Template to Issue

In the list of templates, select the TrusonaUserEnrollment template that was just created and click on OK

4. Configure Active Directory Server Authentication Enrollment Settings

4.1. AD authentication enrollment steps

1. From the Start Menu, click on Windows Administrative Tools
2. Double-click on Certification Authority
3. Right click on Certificate Templates and click on Manage
4. On the list of templates, right click on Web Server and click on Duplicate Template
5. The initial tab will be the Compatibility tab. Do not make any changes there.
6. On the General tab, set the Template display name to be exactly TrusonaAgentEnrollment
7. Make sure to check the box next to Publish certificate in Active Directory and check the box next to Do not automatically reenroll if a duplicate certificate exists in Active Directory
8. On the Subject Name tab, select the second radio button and from the Subject name format dropdown, select Common name.
9. Also, uncheck all boxes except for DNS name
10. On the Security tab, click on Add... and type in Domain Computers and then click on OK
11. In the list Group or user names, highlight each row and confirm that they have Read and Enroll permissions. If they do not, enable both.
12. When completed, click on OK
13. Right click on Certificate Templates, navigate to New and then to Certificate Template to Issue
14. Select TrusonaAgentEnrollment and click on OK

4.2. AD authentication enrollment walk through

From the Start Menu, click on Windows Administrative Tools

Double-click on Certification Authority

Right click on Certificate Templates and click on Manage

On the list of templates, right click on Web Server and click on Duplicate Template

The initial tab will be the Compatibility tab. Do not make any changes there.

On the General tab, set the Template display name to be exactly TrusonaAgentEnrollment

Make sure to check the box next to Publish certificate in Active Directory and check the box next to Do not automatically reenroll if a duplicate certificate exists in Active Directory

On the Subject Name tab, select the second radio button and from the Subject name format dropdown, select Common name.

Also, uncheck all boxes except for DNS name. Make sure that the box Include e-mail name in subject name is also unchecked.

On the Security tab, click on Add... and type in Domain Computers and then click on OK

In the list Group or user names, highlight each row and confirm that they have Read and Enroll permissions. If they do not, enable both.

When completed, click on OK

Right click on Certificate Templates, navigate to New and then to Certificate Template to Issue

Select TrusonaAgentEnrollment and click on OK

5. Server KDC Enrollment

5.1. Server KDC enrollment steps

1. From a PowerShell administrative prompt, start the Microsoft Management Console:
2. From the File menu, click on Add/Remove Snap-in...
3. Select Certificates and click on Add
4. On the next selection prompt, choose Computer account and click on next
5. On the next prompt, choose Local computer and click on Finish
   1. We are making the assumption that the computer running the Trusona Agent is the local computer:
6. Expand on Certificates and right click on Personal and follow All Tasks -> Request New Certificate...
7. When loaded, click on Next
8. Select Active Directory Enrollment Policy
9. Click on Enroll after selecting the check boxes for:
   1. Domain Controller
   2. Domain Controller Authentication; and
   3. Kerberos Authentication
10. Wait a couple of seconds and you should have successful enrollment

5.2. Server KDC enrollment walk through

From a PowerShell administrative prompt, start the Microsoft Management Console:

From the File menu, click on Add/Remove Snap-in...

Select Certificates and click on Add

On the next selection prompt, choose Computer account and click on next

On the next prompt, choose Local computer and click on Finish

We are making the assumption that the computer running the Trusona Agent is the local computer:

Expand on Certificates and right click on Personal and follow All Tasks -> Request New Certificate...

When loaded, click on Next

Select Active Directory Enrollment Policy

Click on Enroll after selecting the check boxes for:

1. Kerberos Authentication

Wait a couple of seconds and you should have successful enrollment

6. Agent Service Installation

6.1. Agent install steps

1. Before beginning, make sure you are logged in with local administrative rights.
2. To begin, double-click on the provided installer. You should see this initial screen, and be able to click on Next.
3. Enter the Token as copied from the Trusona Dashboard into the SDK Token field.
4. Enter the Secret as copied from the Trusona Dashboard into the SDK Secret field.
5. Enter the Integration ID as copied from the Trusona Dashboard into the Integration ID field.
6. Certificate Thumbprint field is optional.
7. Click on Install
8. After a short while, it will complete the installation and you should be able to click on Close which will exit you from the installer.
9. After installation, please open firewall port 34182 for TCP IN

6.2. Agent install walk through

First, access your Trusona Dashboard.

Create both SDK Server Credentials and a Windows Integration.

Note the SDK Token, SDK Secret and Integration ID.

Secondly, right-click on the provided installer and click on Run as administrator. You should see this initial screen, and be able to click on Next

Enter the SDK Token that was copied from the Trusona Dashboard.

Enter the SDK Secret that was copied from the Trusona Dashboard.

Enter the Integration ID that was copied from the Trusona Dashboard.

Certificate Thumbprint field is optional, and should only be filled in if you are providing your own SSL certificate to the agent.

Click on Install

After a short while, it will complete the installation and you should be able to click on Close which will exit you from the installer.

6.3. Agent Status Validation

Once the agent is installed, you can visit the URL https://FQDN_Agent_Hostname:34182/configuration to confirm it loads.

Replace FQDN_Agent_Hostname with the correct FQDN of the agent’s host.

7. Optional: Disabling password-based authentication

After the user has installed the Trusona mobile app and completed setup, it is possible to disable the password option for future authentications. This step is optional.

1. After a user goes through the Trusona Windows Setup, open the Server Manager and go to Active Directory Users and Computers under the Tools menu.
2. Browse to the specific user, right click on their icon and go to Properties.
3. Click on the Account tab.
4. Scroll in the Account options list and enable the Smart card is required for interactive logon checkbox.
5. Click on Apply and then on OK
6. Going forward, that user will be required to use Trusona to complete an interactive logon on their Trusona-enabled workstation.

7.1. Disabling passwords walk through

After a user goes through the Trusona Windows Setup, open the Server Manager and go to Active Directory Users and Computers under the Tools menu.

Browse to the specific user, right click on their icon and go to Properties

Click on the Account tab.

Scroll in the Account options list and enable the Smart card is required for interactive logon checkbox.

Click on Apply and then on OK

Going forward, that user will be required to use Trusona to complete an interactive logon on their Trusona-enabled workstation. They will not be able to use their password to login while this option is enabled.

8. Credential Provider Installation

8.1. Manual Installation

1. Before beginning, make sure this computer has a TPM and that you are logged in with local administrative rights
2. On the client workstation, run the Trusona Credential Provider Installer
3. When prompted, specify the Fully Qualified Hostname of the server hosting the Agent, and click on Install
4. After installation, please open firewall port 34182 for TCP OUT

8.2. CLI Installation

On an elevated command prompt, type the following command to complete a silent command-line installation:

Example showing passwordless sign-in installation.

msiexec.exe /q /i Z:\path\to\trusona-credential-provider-x.y.z.msi ENDPOINT=FQDN_agent_hostname MFAMODE=no

Be sure to specify the correct path the MSI file.

Be sure to specify the correct FQDN of the hostname where the Trusona Agent is installed.

Set MFAMODE=no to require only Trusona at sign-in.

8.3. Automated Install using Active Directory Group Policy

The Trusona Credential Provider may be installed and configured using Active Directory Group Policy.

8.3.1. Prerequisite: Create the policy central store for your domain

You may wish to create a central policy store if you have multiple domain controllers. For more information, visit How to create and manage the Central Store for Group Policy Administrative Templates in Windows

1. Create a new group policy object which will be used to configure the Trusona Credential Provider

8.3.2. Prerequisite: Install and configure the Wait For Network Policy

1. Copy %WINDIR%\PolicyDefinitions\en-us\Logon.adml to the corresponding location within your central policy store, if not using the default.
2. Copy %WINDIR%\PolicyDefinitions\Logon.admx to the corresponding location within your central policy store, if not using the default.
3. Within the previously created policy object, expand Computer Configuration → Policies → Administrative Templates → Logon and open the setting item Always wait for the network at computer startup and logon
4. Mark the item as Enabled and click OK.

8.3.3. Install and configure the Trusona Group Policy Template

Trusona will provide to you an ADMX template that can be used to remotely configure the Credential Provider.

1. Copy TrusonaAgentPolicy.adml to your GPO policies en-us directory. If you are using a central policy store, this directory is \\<HOST>\SYSVOL\policies\PolicyDefinitions\en-us, otherwise it is %WINDIR%\PolicyDefinitions\en-us
2. Copy TrusonaAgentPolicy.admx to your GPO policies directory. If you are using a central policy store, this directory is \\<HOST>\SYSVOL\policies\PolicyDefinitions, otherwise it is %WINDIR%\PolicyDefinitions
3. Within the previously created policy object, expand Computer Configuration → Policies → Administrative Templates → Trusona and open the setting item Trusona Agent's Fully Qualified Domain Name
4. Mark the item as Enabled provide the FQDN of the server hosting the agent.
5. Select Sign-in options Require Trusona at sign-in and click OK.

8.3.4. Deploying the Trusona Credential Provider

Once the Credential Provider configuration has been deployed, you can easily distribute the package to your computers silently.

1. Copy the Trusona Credential Provider Installer to an accessible network location
2. Expand Computer Configuration → Policies → Software Settings
3. Right-click Software installation and choose New → Package
4. Select the Trusona Credential Provider Installer MSI from the network location in Step 1
5. When prompted, choose Assign

8.3.5. Assign the GPO

1. Using the Group Policy Management tool, assign the Trusona Group Policy Object to an OU containing the workstations you wish to target for passwordless users.

---