Installing Trusona for Windows 10

This guide details the steps required to install and configure Trusona's Active Directory Agent and Credential Provider.

1. Install Active Directory Certificate Services (ADCS)

1.1. ADCS installation Steps

  1. Login as an Enterprise Administrator
  2. Open the Server Manager on the Active Directory instance to be used
  3. On the right hand side, click on Manage and select Add Roles and Features
  4. Next, for installation type, select Role-based or feature-based installation
  5. Select the target server from the provided selection
  6. Check off Active Directory Certificate Services from the list of available Server Roles
  7. Click on Add Features on the screen that pops up
  8. Accept the pre-selected values on the features list
  9. Click on Next
  10. In the list of Role Services, check off Certification Authority and click on Next
  11. Check off the option to restart the destination server automatically if required
  12. Finally, review previously made selections then click on Install
  13. Installation should complete successfully in a short while. When done click on Close

1.2. ADCS installation walk through

Open the Server Manager on the Active Directory instance to be used.

Server manager

On the right hand side, click on Manage and select Add Roles and Features:

Add Roles and Features
Add Roles and Features

Next, for installation type, select Role-based or feature-based installation:

Role-based or feature-based installation
Role-based or feature-based installation

Select the target server from the provided selection:

server pool selection
server pool selection

Check off Active Directory Certificate Services from the list of available Server Roles:

Active Directory Certificate Services
Active Directory Certificate Services

Click on Add Features on the screen that pops up:

Add Features
Add Features

Accept the pre-selected values on the features list:

Select Features
Select Features

Click on Next

In the list of Role Services, check off Certification Authority and click on Next

Role Services
Role Services

Check off the option to restart the destination server automatically if required:

Restart if required
Restart if required

Finally, review previously made selections then click on Install

Installation should complete successfully in a short while. When done click on Close

2. Configure Active Directory Certificate Services

2.1. ADCS configuration steps

  1. Inside the Server Manager, click on Manage on the top right menu, and select Configure Active Directory Certificate Services...
  2. Provide appropriate credentials as recommended in the details, then click on Next
  3. Select Certification Authority, then click on Next
  4. Select Enterprise CA, then click on Next
  5. Select Root CA, then click on Next
  6. For a new installation, select create a new private key, then click on Next. If this is not a new installation, provide a existing private key
  7. Keep the default pre-selected values on this screen, then click on Next
  8. Make the appropriate changes on this screen by providing correct values for all three fields, then click on Next
  9. Specify an appropriate validity period, then click on Next
  10. Keep the default values, then click on Next
  11. Confirm the previously select values. If you want, you may go back and make changes as necessary, then click on Configure
  12. Configuration should complete in a short while. After it is done, click on Close

2.2. ADCS configuration walk through

Inside the Server Manager, click on Manage on the top right menu, and select Configure Active Directory Certificate Services...

Provide appropriate credentials as recommended in the details, then click on Next

Select Certification Authority, then click on Next

Select Enterprise CA, then click on Next

Select Root CA, then click on Next

For a new installation, select create a new private key, then click on Next. If this is not a new installation, provide a existing private key:

Keep the default pre-selected values on this screen, then click on Next

Make the appropriate changes on this screen by providing correct values for all three fields, then click on Next

Specify an appropriate validity period, then click on Next

Keep the default values, then click on Next

Confirm the previously select values. If you want, you may go back and make changes as necessary, then click on Configure

Configuration should complete in a short while. After it is done, click on Close

3. Configure Active Directory Certificate Enrollment Settings

3.1. ADCS enrollment steps

  1. From the Start Menu, click on Windows Administrative Tools
  2. Click on Certification Authority
  3. Right click on Certificate Template and click on Manage
  4. Right click on Smartcard User and click on Duplicate Template
  5. By default, the initial tab will be Compatibility. Do not make any changes on this tab.
  6. On the General tab, specify the template display name as exactly TrusonaUserEnrollment
  7. On the Request Handling tab, at the purpose drop drown, select Signature and smartcard logon
  8. On the Cryptography tab, specify a minimum key size of 2048.
  9. Additionally, select the Requests must use one of the following providers radio button and check off Microsoft Base Smart Card Crypto Provider
  10. On the Subject Name tab, uncheck boxes all except for User principal name (UPN)
  11. On the Security tab, select Authenticated Users in the upper section, then check off Read and Enroll permissions in the lower section
  12. Click on Apply and then OK
  13. Right click on Certificate Templates one more time.
  14. Go to New and click on Certificate Template to Issue
  15. In the list of templates, select the TrusonaUserEnrollment template that was just created and click on OK

3.2. ADCS enrollment walk through

From the Start Menu, click on Windows Administrative Tools

Click on Certification Authority

Right click on Certificate Template and click on Manage

Right click on Smartcard User and click on Duplicate Template

By default, the initial tab will be Compatibility. Do not make any changes on this tab.

On the General tab, specify the template display name as exactly TrusonaUserEnrollment

On the Request Handling tab, at the purpose drop drown, select Signature and smartcard logon

On the Cryptography tab, specify a minimum key size of 2048.

Additionally, select the Requests must use one of the following providers radio button and check off Microsoft Base Smart Card Crypto Provider

On the Subject Name tab, uncheck boxes all except for User principal name (UPN)

On the Security tab, select Authenticated Users in the upper section, then check off Read and Enroll permissions in the lower section

Click on Apply and then OK

Right click on Certificate Templates one more time.

Go to New and click on Certificate Template to Issue

In the list of templates, select the TrusonaUserEnrollment template that was just created and click on OK

4. Configure Active Directory Server Authentication Enrollment Settings

4.1. AD authentication enrollment steps

  1. From the Start Menu, click on Windows Administrative Tools
  2. Double-click on Certification Authority
  3. Right click on Certificate Templates and click on Manage
  4. On the list of templates, right click on Web Server and click on Duplicate Template
  5. The initial tab will be the Compatibility tab. Do not make any changes there.
  6. On the General tab, set the Template display name to be exactly TrusonaAgentEnrollment
  7. Make sure to check the box next to Publish certificate in Active Directory and check the box next to Do not automatically reenroll if a duplicate certificate exists in Active Directory
  8. On the Subject Name tab, select the second radio button and from the Subject name format dropdown, select Common name.
  9. Also, uncheck all boxes except for DNS name
  10. On the Security tab, click on Add... and type in Domain Computers and then click on OK
  11. In the list Group or user names, highlight each row and confirm that they have Read and Enroll permissions. If they do not, enable both.
  12. When completed, click on OK
  13. Right click on Certificate Templates, navigate to New and then to Certificate Template to Issue
  14. Select TrusonaAgentEnrollment and click on OK

4.2. AD authentication enrollment walk through

From the Start Menu, click on Windows Administrative Tools

Double-click on Certification Authority

Right click on Certificate Templates and click on Manage

On the list of templates, right click on Web Server and click on Duplicate Template

The initial tab will be the Compatibility tab. Do not make any changes there.

On the General tab, set the Template display name to be exactly TrusonaAgentEnrollment

Make sure to check the box next to Publish certificate in Active Directory and check the box next to Do not automatically reenroll if a duplicate certificate exists in Active Directory

On the Subject Name tab, select the second radio button and from the Subject name format dropdown, select Common name.

Also, uncheck all boxes except for DNS name. Make sure that the box Include e-mail name in subject name is also unchecked.

On the Security tab, click on Add... and type in Domain Computers and then click on OK

In the list Group or user names, highlight each row and confirm that they have Read and Enroll permissions. If they do not, enable both.

When completed, click on OK

Right click on Certificate Templates, navigate to New and then to Certificate Template to Issue

Select TrusonaAgentEnrollment and click on OK

5. Server KDC Enrollment

5.1. Server KDC enrollment steps

  1. From a PowerShell administrative prompt, start the Microsoft Management Console:
  2. From the File menu, click on Add/Remove Snap-in...
  3. Select Certificates and click on Add
  4. On the next selection prompt, choose Computer account and click on next
  5. On the next prompt, choose Local computer and click on Finish
    1. We are making the assumption that the computer running the Trusona Agent is the local computer:
  6. Expand on Certificates and right click on Personal and follow All Tasks -> Request New Certificate...
  7. When loaded, click on Next
  8. Select Active Directory Enrollment Policy
  9. Click on Enroll after selecting the check boxes for:
    1. Domain Controller
    2. Domain Controller Authentication; and
    3. Kerberos Authentication
  10. Wait a couple of seconds and you should have successful enrollment

5.2. Server KDC enrollment walk through

From a PowerShell administrative prompt, start the Microsoft Management Console:

From the File menu, click on Add/Remove Snap-in...

Select Certificates and click on Add

On the next selection prompt, choose Computer account and click on next

On the next prompt, choose Local computer and click on Finish

We are making the assumption that the computer running the Trusona Agent is the local computer:

Expand on Certificates and right click on Personal and follow All Tasks -> Request New Certificate...

When loaded, click on Next

Select Active Directory Enrollment Policy

Click on Enroll after selecting the check boxes for:

  1. Domain Controller
  2. Domain Controller Authentication; and
  3. Kerberos Authentication

Wait a couple of seconds and you should have successful enrollment

6. Agent Service Installation

Along with the installer, you should have been provided with a token and secret by Trusona.

6.1. Agent install steps

  1. Before beginning, make sure you are logged in with local administrative rights
  2. To begin, double-click on the provided installer. You should see this initial screen, and be able to click on Next.
  3. Enter the token that was provided by your Trusona contact into the SDK Token field
  4. Enter the secret that was provided by your Trusona contact into the SDK Secret field
  5. Click on Install
  6. After a short while, it will complete the installation and you should be able to click on Close which will exit you from the installer
  7. After installation, please open firewall port 34182 for TCP IN

6.2. Agent install walk through

To begin, double-click on the provided installer. You should see this initial screen, and be able to click on Next

Enter the secret that was provided by your Trusona contact into the SDK Secret field.

Next, enter the token that was provided by your Trusona contact into the SDK Token field.

Click on Install

After a short while, it will complete the installation and you should be able to click on Close which will exit you from the installer.

7. Optional: Disabling password-based authentication

After the user has installed the Trusona mobile app and completed setup, it is possible to disable the password option for future authentications. This step is optional.

  1. After a user goes through the Trusona Windows Setup, open the Server Manager and go to Active Directory Users and Computers under the Tools menu.
  2. Browse to the specific user, right click on their icon and go to Properties.
  3. Click on the Account tab.
  4. Scroll in the Account options list and enable the Smart card is required for interactive logon checkbox.
  5. Click on Apply and then on OK
  6. Going forward, that user will be required to use Trusona to complete an interactive logon on their Trusona-enabled workstation.

7.1. Disabling passwords walk through

After a user goes through the Trusona Windows Setup, open the Server Manager and go to Active Directory Users and Computers under the Tools menu.

Browse to the specific user, right click on their icon and go to Properties

Click on the Account tab.

Scroll in the Account options list and enable the Smart card is required for interactive logon checkbox.

Click on Apply and then on OK

Going forward, that user will be required to use Trusona to complete an interactive logon on their Trusona-enabled workstation. They will not be able to use their password to login while this option is enabled.

8. Credential Provider Installation

8.1. Manual Installation

  1. Before beginning, make sure this computer has a TPM and that you are logged in with local administrative rights
  2. On the client workstation, run the Trusona Credential Provider Installer
  3. When prompted, specify the Fully Qualified Hostname of the server hosting the Agent, and click on Install
  4. After installation, please open firewall port 34182 for TCP OUT

8.2. Automated Install using Active Directory Group Policy

The Trusona Credential Provider may be installed and configured using Active Directory Group Policy.

8.2.1. Prerequisite: Create the policy central store for your domain

You may wish to create a central policy store if you have multiple domain controllers. For more information, visit How to create and manage the Central Store for Group Policy Administrative Templates in Windows

8.2.2. Install and configure the Trusona Group Policy Template

Trusona will provide to you an ADMX template that can be used to remotely configure the Credential Provider.

  1. Copy TrusonaAgentPolicy.adml to your GPO policies en-us directory. If you are using a central policy store, this directory is \\SYSVOL\policies\PolicyDefinitions\en-us, otherwise it is %WINDIR%\PolicyDefinitions\en-us.
  2. Copy TrusonaAgentPolicy.admx to your GPO policies directory. If you are using a central policy store, this directory is \\SYSVOL\policies\PolicyDefinitions, otherwise it is %WINDIR%\PolicyDefinitions.
  3. Create a new group policy object which will be used to configure the Credential Provider
  4. Expand Computer ConfigurationPoliciesAdministrative TemplatesTrusona and open the setting item Trusona Agent's Fully Qualified Domain Name
  5. Mark the item as Enabled and provide the FQDN of the server hosting the agent

8.2.3. Deploying the Trusona Credential Provider

Once the Credential Provider configuration has been deployed, you can easily distribute the package to your computers silently.

  1. Copy the Trusona Credential Provider Installer to an accessible network location
  2. Expand Computer ConfigurationPoliciesSoftware Settings
  3. Right-click Software installation and choose NewPackage
  4. Select the Trusona Credential Provider Installer MSI from the network location in Step 1
  5. When prompted, choose Assign

8.2.4. Assign the GPO

  1. Using the Group Policy Management tool, assign the Trusona Group Policy Object to an OU containing the workstations you wish to target for passwordless users.

Integrations

Desktop
IAM and SSO
PAM
Productivity
RADIUS
VPN

Guides

Get started guides
Implementation guides
Users guides

SDKs

Mobile SDKs
Server SDKs
Web SDKs

APIs

Authentication Service
ID Proofing Service

TOTP

Business
E-commerce
Finance
Productivity
Social
Gaming
Other