TWO-FACTOR AUTHENTICATION ISSUES IN THE WINDOWS DOMAIN: TOKENS
Abstract
This article examines the problem of increasing the security of corporate information systems by implementing two-factor authentication (2FA) based on the RuToken hardware token in a Windows domain environment. Key vulnerabilities of traditional password authentication, phishing, password interception, and user errors are highlighted. A public key infrastructure (PKI) architecture is explored, where the private key remains only on the physical medium, and the public key is stored on the user's computer. A comparative analysis of several user authorization methods, such as password authentication (Password-only), SMS / Email OTP (One-Time Password), TOTP (Time-based One-Time Password), FIDO2 / WebAuthn, and RuToken + PKI, is conducted, as a result of which their vulnerabilities and advantages are identified. The main comparison criteria are vulnerability to phishing and MITM (Man-in-the-Middle) attacks, dependence on an internet connection, the possibility of centralized management, and the complexity of deployment. Particular attention is given to the practical implementation of RuToken + PKI in a domain environment without internet access. The article demonstrates the configuration of Active Directory Certificate Services (AD CS), group policies, and certificate templates, which enable user account login using a RuToken smart card. The article identifies the challenges of using this architecture in a domain environment, including dependence on cryptographic drivers, the risk of losing the physical drive or PIN, and more. The experiment was conducted using Windows Server 2025 and Windows 11, deployed on an Oracle VirtualBox virtual machine. The result demonstrates the effectiveness of the PKI approach in a domain environment compared to traditional security levels.
Online viewer
References
- NIST Special Publication 800-63B. (2020). Digital Identity Guidelines: Authentication and Lifecycle Management. National Institute of Standards and Technology, Gaithersburg. URL: https://pages.nist.gov/800-63-3/sp800-63b.html (date of access: 02.01.2026).
- Aktiv JSC. Rutoken: Documentation for developers and administrators [Electronic resource]. Rutoken.ru: official website. Moscow. URL: https://dev.rutoken.ru (date of access: 02.01.2026).
- Grekov, V. S., & Uymin, A. G. (2024). Strategies for creating an enterprise network model within a cyber range for effective cybersecurity personnel training. Vestnik kiberbezopasnosti, (3), 45–58. URL: https://www.elibrary.ru/item.asp?id=80499001 (date of access: 04.01.2026).
- GOST R 57580.1–2017. (2017). Information technology. Cryptographic information protection. Public key infrastructure: National standard of the Russian Federation. Moscow: Standartinform. URL: https://regulhub.kaspersky.ru/upload/iblock/71a/k99732yk7w1rrz8d3yg3y4hwqzmg8bcw.pd f (date of access: 04.01.2026).
- Smart Card Logon Architecture [Electronic resource]. (2025). Microsoft Learn: official documentation portal. Redmond. URL: https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-architecture (date of access: 05.01.2026).
- Gnezdilov, R. R. (2018). Multifactor authentication and the efficiency of information security when accessing telecommunication network resources. In Gagarin Readings – 2018: Proceedings of the XLIV International Youth Scientific Conference, Moscow–Akhtubinsk– Baikonur, April 17–20, 2018 (Vol. 1, p. 193). Moscow–Akhtubinsk–Baikonur: Moscow Aviation Institute (National Research University). EDN XMKQST.
- Grosse, E., & Upadhyay, M. (2013). Multifactor authentication. Informatsionnaya bezopasnost, (4), 42–47. EDN SDXTOH.
License
Copyright (c) 2026 A. V. Fomenko, Ya. Yu. Zelenov (Author)