Objective     

This article provides instructions on configuring the Entrust MFA Credential Provider and ADSelfService Plus login agent to coexist on Windows systems. This ensures the ADSelfService Plus login agent appears on the Windows login and lock screen, even when the Entrust MFA Credential Provider is installed.

Why is this important?   

By default, the Entrust MFA Credential Provider may take precedence, hiding the ADSelfService Plus login agent. This configuration allows both providers to operate seamlessly without conflicts.

Prerequisites      

• Supported OS versions: Windows 10, Windows 11, Server 2016, Server 2019, Server 2022

• Administrator privileges on the target Windows machine.

• Access to the Windows Registry Editor (regedit.exe).

Steps to follow 

Manual deployment on single machines 

1. Open the Registry Editor (regedit.exe) by clicking the Windows icon in the bottom-left corner. Search for Registry Editor in the search bar, then press Enter. You can also find the Registry Editor by navigating to Control Panel > All Control Panel Items > Windows Tools > Registry Editor.

2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Entrust > WIGL > AllowCPs.

3. Right-click in the right pane, and select New > String Value.

4. Name the new value as ADSelfService Plus.

5. Double click ADSelfService Plus and enter the following value: {B80B099C-62EA-43CD-9540-3DD26AF3B2B0}

6. Click OK.

7. Close the Registry Editor.

Step 2: Configure ADSelfService Plus login agent 

1. Open Registry Editor (regedit.exe).

2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Wow6432Node > ZOHO Corp > ADSelfService Plus Client Software.

3. Right-click in the right pane and select New > String Value.

4. Name the new value as WrappingProvider.

5. Double-click WrappingProvider and enter the following value: {126DA98F-1690-49c1-91A0-D704D7EEAEBB}

6. Click OK.

7. Close the Registry Editor.

Bulk deployment via Group Policy Object (GPO)   

Step 1: Create a new GPO 

1. Open Group Policy Management Console (GPMC) (gpmc.msc).

2. Right click the desired OU and select Create a GPO in this domain, and Link it here...

3. Name the GPO Wrap Entrust MFA with ADSelfService Plus and click OK.

Step 2: Configure Entrust MFA registry settings 

1. Edit the newly created GPO.

2. Navigate to Computer Configuration > Preferences > Windows Settings > Registry.

3. Right click and select New > Registry Item.

4. Configure the settings as follows:

1. Action: Create

2. Hive: HKEY_LOCAL_MACHINE

3. Key Path: SOFTWARE\Entrust\WIGL\AllowCPs

4. Value Name: ADSelfService Plus

5. Value Type: String Value

6. Value Data: {B80B099C-62EA-43cd-9540-3DD26AF3B2B0}

5. Click OK to save.

 Step 3: Configure ADSelfService Plus Registry Settings  

1. Right click again in the Registry section and select New > Registry Item.

2. Configure the settings as follows:

1. Action: Create

2. Hive: HKEY_LOCAL_MACHINE

3. Key Path: SOFTWARE\Wow6432Node\ZOHO CORP\ADSelfService Plus Client Software

4. Value Name: WrappingProvider

5. Value Type: String Value (REG_SZ)

6. Value Data: {126DA98F-1690-49c1-91A0-D704D7EEAEBB}

3. Click OK to save.

Step 4: Apply the GPO   

1. Close the Group Policy Editor.

2. Run the following command on the domain controller to apply the policy immediately:

gpupdate /force 

3. Restart the target machines for changes to take effect.

Validation and confirmation     

• Verify that the ADSelfService Plus Credential Provider is visible alongside the Entrust MFA Credential Provider on the Windows login and lock screens.

• Test ADSelfService Plus functionality by performing a password reset or account unlock.

Troubleshooting tips     

• If the ADSelfService Plus login agent does not appear, re-check the registry entries for typos or missing values.

• If the Entrust MFA prompts override ADSelfService Plus, confirm that ProvidersWhiteList is correctly set in Entrust MFA’s registry settings.

• Ensure the GPO is applied correctly by running gpresult/r on the target machine.

Best practices      

• Always backup the registry before making modifications.

• Use Group Policy or automated scripts to deploy registry changes on multiple machines.

• Test changes on a non-production system before rolling out to all users.

How to reach support