---
locale: "en"
updated_at: "2026-11-12T14:39:45.455Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/support/faq/fido2-security-keys"
---

# FIDO2 security keys

Find answers about FIDO2 security keys in UserLock: Remote Desktop support, PIN policy, offline sign-in and lost or stolen keys.

## Which FIDO2 security keys can users enroll?

Any FIDO2 (CTAP2) security key, such as YubiKey, Token2, SoloKeys or Feitian keys, used over USB or with an NFC reader. 

The key must have a PIN: if it has none, the user creates one at enrollment. 

See [Enroll users with a FIDO2 security key](/userlock/docs/guides/end-users-mfa-enrollment/fido2-security-key).

## Where can users sign in with a FIDO2 security key?

- Windows sessions, local and over Remote Desktop
- UAC prompts
- RD Gateway, RD Web Access and RemoteApp
- IIS applications
- SaaS applications through UserLock SSO

## Which session hosts and clients support security keys over Remote Desktop and RemoteApp?

The key stays on the client computer, and Windows redirects it into the session through WebAuthn redirection, which requires a supported session host and client.

#### Session host requirements

UserLock Desktop Agent 13.1 or later, and one of these systems:

| Session host OS | Minimum build |
| --- | --- |
| Windows Server 2025 | All builds |
| Windows Server 2022 | 20348.1070 |
| Windows 11 22H2 or later | 22621 |
| Windows 10 21H2 | 19044.2075 |
| Windows Server 2019 and earlier | ❌ **Not supported** |

#### Remote Desktop client

Supported clients are: 

- ✅ Remote Desktop Connection (`mstsc.exe`),
- ✅ the Windows App,
- ✅ Hyper-V VMConnect in enhanced session mode.

Not supported:

- ❌ The VMConnect basic session,
- ❌ the Microsoft Store “Remote Desktop” app,
- ❌ most third-party clients.

## How do I allow WebAuthn redirection on session hosts?

WebAuthn redirection is allowed by default. If security keys don’t work over Remote Desktop, check two settings on the session hosts:

- **Group Policy**: the **Do not allow WebAuthn redirection** policy must be **Not Configured** or **Disabled**. The policy is in:  
`Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection`

- **RDP files**: the .rdp files and RemoteApp programs you publish must not contain `redirectwebauthn:i:0`.

If either setting blocks redirection, security keys don’t work. Redirection works with on-premises Active Directory: Microsoft Entra join isn’t required.

## The security key prompt doesn’t appear in a Remote Desktop session. What should I check?

- The user connects with `mstsc.exe`, the Windows App or VMConnect in enhanced session mode.
- The session host runs a supported system and build. Windows Server 2019 isn’t supported.
- WebAuthn redirection isn’t blocked by GPO or by the .rdp file.
- The session host runs the UserLock Desktop Agent 13.1 or later.

See [Which session hosts and clients support security keys over Remote Desktop and RemoteApp?](/userlock/docs/support/faq/fido2-security-keys#4b33f93f-9ecc-4d44-8481-54d485e23e83)

## Can users enroll a security key from a Remote Desktop session?

Yes, when the session host and the Remote Desktop client support security key redirection. 

See [Which session hosts and clients support security keys over Remote Desktop and RemoteApp?](/userlock/docs/support/faq/fido2-security-keys#4b33f93f-9ecc-4d44-8481-54d485e23e83)

## How do I require the PIN at every sign-in?

By default, users only touch or tap their key at online sign-in. 
The PIN is always required at enrollment and for offline sign-in.

To require the key’s PIN every time:

1. Go to ⚙ **Server settings**** ▸ ****[Advanced settings](/userlock/docs/reference/server-settings/advanced-settings)**.
2. In the **Multi-Factor Authentication** category, change **FIDO2 user verification** from **Discouraged** (default) to **Required**.
3. Select **Save**.

With PowerShell:

```
Set-UserLockServerConfiguration MfaFido2UserVerification Required
```

The PIN is always required at enrollment and for offline sign-in, regardless of this setting.

**⚠️ Advanced settings can affect UserLock stability and security. Change only FIDO2 user verification.**

## Can users sign in with a security key when their computer is offline?

Yes, on a computer where they already signed in online with this key. Enrollment counts as the first online sign-in on the enrollment computer. Users who work on several computers must sign in online once on each of them. 

Offline sign-in always requires the key’s PIN. To require MFA when computers can’t reach the UserLock server, see [Require MFA when the agent can’t reach UserLock](/userlock/docs/guides/mfa-implementation/how-to-implement-mfa#require-mfa-for-connections-from-outside).

## Which backup methods can users combine with a security key?

A second security key or an authenticator app (TOTP), plus recovery codes if you enable them. 

Each user can enroll two security keys, or one key and one other method. Users can’t combine a security key with Push notifications or USB keys (HOTP).

Whether users can register a backup depends on the **Alternative MFA method** setting. See [Configure your MFA methods](/userlock/docs/guides/mfa-implementation/configure-your-mfa-methods).

## How do I replace a lost or stolen FIDO2 security key?

Resetting the user’s MFA configuration removes all their MFA methods, including a backup key that wasn’t lost.

1. Reset the user’s MFA configuration. See [Help users who can’t complete MFA](/userlock/docs/guides/mfa-implementation/how-to-implement-mfa#help-users-who-cant-complete-mfa).
2. If the user can’t sign in until they receive a new key, temporarily disable MFA for them, for the shortest possible time.
3. Ask the user to enroll at their next sign-in with the replacement key, and with their backup key if they have one. The reset removes all their security keys.

**⚠️ **

**A computer applies the reset only at its next contact with the UserLock server.** Until then, the lost key can still be used to sign in offline on that computer, with its PIN.

## Can I change the relying-party ID after users have enrolled?

Yes, but every user enrolled with FIDO2 must enroll again, because each key is bound to the RP ID set at enrollment. Contact IS Decisions support before you change it.

1. Reset the MFA configuration of every user enrolled with FIDO2. To list them, click the enrolled users count on the **FIDO2 security keys** card.
2. In ⚙️ **Server settings**** ▸ ****MFA**, click the edit icon next to the RP ID on the **FIDO2 security keys** card. This requires full permission on Server settings.
3. Set the new RP ID, then select **Continue** and **Save**.

Users enroll their keys again at their next sign-in. If a user is still enrolled, the edit icon opens the **Unenroll FIDO2 users to change the RPID** dialog instead.

## What is the RP ID on a Standalone Terminal Server?

The machine name. On a Standalone Terminal Server, enabling FIDO2 opens no dialog: UserLock sets the RP ID automatically, and you can’t edit it.

## What happens to enrolled keys if I disable FIDO2 security keys?

Users already enrolled can still sign in with their key, but new users can’t enroll with FIDO2. UserLock keeps the RP ID, so enrolled keys keep working when you enable FIDO2 again. 

While at least one user is enrolled, the RP ID and the domain of the IIS MFA public URL stay locked.