Objective   

This article provides instructions on configuring the Duo Windows Logon client and ADSelfService Plus login agent to coexist on Windows systems. This ensures the ADSelfService Plus login agent appears on the Windows login and lock screen, even when the Duo Windows Logon client is installed.

Why is this important?  

By default, the Duo Windows Logon client may take precedence, hiding the ADSelfService Plus login agent. This configuration allows both providers to operate seamlessly without conflicts.

Prerequisites   

• Supported OS versions: Windows 10, 11, Server 2016, Server 2019, Server 2022

• Administrator privileges on the target Windows machine

• Access to the Windows Registry Editor (regedit.exe)

Steps to follow 

For manual deployment on individual machines

Step 1: Configure the Duo Windows Logon client

1. Open the Registry Editor (regedit.exe) by clicking the Windows icon in the bottom-left corner. In the search bar, type Registry Editor and press Enter. You can also find the Registry Editor by navigating to Control Panel > All Control Panel Items > Windows Tools > Registry Editor.

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Duo Security\DuoCredProv.

3. In the right pane, right-click and select New > Multi-String Value.

4. Name the new value ProvidersWhiteList.

5. Double click ProvidersWhiteList and enter the following value: {B80B099C-62EA-43CD-9540-3DD26AF3B2B0}.

6. Click OK.

7. Close the Registry Editor.

Step 2: Configure the ADSelfService Plus login agent

1. Open Registry Editor (regedit.exe).

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ZOHO CORP\ADSelfService Plus Client Software.

3. In the right pane, right-click and select New > String Value.

4. Name the new value WrappingProvider.

5. Double-click WrappingProvider and enter the following value: {44E2ED41-48C7-4712-A3C3-250C5E6D5D84}

6. Click OK.

7. Close the Registry Editor.

For bulk deployment via Group Policy Object (GPO)  

1. Open Group Policy Management Console (GPMC) (gpmc.msc).

2. Right-click the desired OU and select Create a GPO in this domain, and Link it here...

3. Name the GPO Wrap Duo with ADSelfService Plus and click OK.

Step 2: Configure Duo Security Registry settings

1. Edit the newly created GPO.

2. Navigate to Computer Configuration > Preferences > Windows Settings > Registry.

3. Right-click and select New > Registry Item.

4. Configure the settings as follows:

1. Action: Create

2. Hive: HKEY_LOCAL_MACHINE

3. Key Path: SOFTWARE\Duo Security\DuoCredProv

4. Value Name: ProvidersWhiteList

5. Value Type: Multi-String Value (REG_MULTI_SZ)

6. Value Data: {B80B099C-62EA-43cd-9540-3DD26AF3B2B0}

5. Click OK to save.

Step 3: Configure ADSelfService Plus Registry settings

1. Right-click again in the Registry section and select New > Registry Item.

2. Configure the settings as follows:

1. Action: Create

2. Hive: HKEY_LOCAL_MACHINE

3. Key Path: SOFTWARE\Wow6432Node\ZOHO CORP\ADSelfService Plus Client Software

4. Value Name: WrappingProvider

5. Value Type: String Value (REG_SZ)

6. Value Data: {44E2ED41-48C7-4712-A3C3-250C5E6D5D84}

3. Click OK to save.

Step 4: Apply the GPO  

1. Close the Group Policy Editor.

2. Run the following command on the domain controller to apply the policy immediately:

gpupdate /force 

3. Restart the target machines for changes to take effect.

Validation and confirmation   

• Verify that the ADSelfService Plus login agent is visible alongside the Duo Security Windows Logon client on the Windows login and lock screens.
  
• Test ADSelfService Plus functionality by performing a password reset or account unlock.
  

Troubleshooting tips   

• If the ADSelfService Plus login agent does not appear, re-check the registry entries for typos or missing values.

• If the Duo Security prompts override ADSelfService Plus, confirm that ProvidersWhiteList is correctly set in Duo Security’s registry settings.

• Ensure the GPO is applied correctly by running gpresult/r on the target machine.

Best practices   

• Always backup the registry before making modifications.

• Use group policy or automated scripts to deploy registry changes on multiple machines.

• Test changes on a non-production system before rolling out to all users.

How to reach support