UserLock vs. Duo: MFA for on-premises Active Directory

Built for environments built around Active Directory, UserLock adds multi-factor authentication (MFA) to existing AD user accounts at the AD authentication layer. Duo adds MFA through its cloud directory, which keeps a synced copy of your users. If you're evaluating UserLock vs Duo, that architectural difference shapes what "best fit" looks like for your environment.

Duo is a common choice when identity already lives in Entra ID or another cloud IdP. UserLock wins where everything needs to stay on prem, in airgapped environments, or where granular policy application at the session level is key. Here, we'll compare the two for teams where AD is still the primary identity store.

UserLock installs on your network and reads AD directly. Policies map to the users, groups and OUs you already have. When you disable an account or move a user to a new group, the change applies to UserLock right away. A disabled user loses access now, not at the next sync. There is no second directory to keep in step.

Duo runs in the cloud. To use AD, you install the Duo Authentication Proxy on a server in your network. It reads AD and sends user and group information to Duo's cloud (passwords are not copied). By default that sync runs twice a day. You can opt into a higher-frequency schedule or click Sync Now, but it is still a copy that you manage alongside AD.

For a small, stable user base, sync timing rarely matters. For organizations with frequent joiners, leavers and role changes, or auditors who ask how fast access is revoked, it does.

Duo Legacy AD Protection is Duo's closest product to UserLock. It adds MFA to Kerberos and NTLM logons by installing a filter on every domain controller. Its biggest limit is MFA methods: it supports only Duo Push and phone call, and neither is phishing-resistant.

UserLock MFA works without an internet connection, so it fits disconnected sites, defense and government networks, and air-gapped environments. Admins choose the offline behavior once, in a global setting: always allow the logon, ask for MFA, force MFA, or always deny. Users already enrolled in MFA need no extra setup.

Duo needs to reach its cloud service on port 443 to authenticate. Offline access exists for Windows Logon, with limits:

• Users must first authenticate online, then enroll for offline access.

• Each user can register one offline authenticator: Duo Mobile or a U2F key (U2F for local console logons only).

• By default, five users can enroll per machine (configurable up to 50).

• Duo states that offline access for RDP logons is not officially supported or tested.

This is where the two products differ most. Duo for Windows Logon applies MFA to all interactive logons, or to RDP only.

UserLock lets you set MFA and access rules per session type: workstation logon, server logon, RDP, VPN, IIS and UAC. You can require MFA for remote sessions and skip it at the office desk, or the reverse. You can also:

• Limit concurrent sessions per user, which blocks credential sharing and makes stolen session tokens harder to reuse

• Restrict access by machine, IP range and time of day

• See and close active sessions in real time

• Your identities are already in Entra ID, Okta or another cloud IdP

• Most of what you need to protect is SaaS and cloud apps

• You want device trust and risk-based policies in the same tool

• You already run Cisco security products

• Active Directory is still your primary identity store, on-premises or hybrid

• You need MFA on Windows logon, RDP, VPN, RD Gateway or IIS without migrating identity

• Remote users log on off-domain, without a VPN

• You run offline sites or air-gapped networks

• You need session-level controls to keep security lightweight or for compliance with frameworks such as CMMC, HIPAA, PCI DSS, NIS2 or ISO 27001

Duo lists Essentials at $3, Advantage at $6 and Premier at $9 per user per month, with a free plan for up to 10 users. Licenses are sold in blocks of 10 under 100 users, and blocks of 25 above.

UserLock is an annual subscription priced per active users. See UserLock pricing.

No. UserLock installs on your network and reads AD directly, so there is no proxy to set up and no directory to sync. Agents deploy automatically to your machines.

Yes. Admins set how UserLock handles offline logons, including requiring MFA. Users already enrolled in MFA need no extra setup.

Yes. Duo syncs users from AD into its cloud through the Duo Authentication Proxy. AD stays your directory, but Duo keeps its own copy of users and groups.

Partly. Duo for Windows Logon supports offline access for enrolled users with Duo Mobile or a U2F key. Each user must first log on online, and RDP offline is not officially supported.

No. UserLock sits on top of AD and uses your existing users, groups and OUs.

Yes. See 9 Duo alternatives for multi-factor authentication.