<div>
also we only have 5 clients workstations.
</div>


<div>
Hello,<br>the task of a domain controller is the central authentication. So every user gets its single and unique ID and this can be used to set permissions anywhere (all domain members). &nbsp;<br>If you do not have a central authentication, you have to authenticate against each single device. And each user is unique on each device. The only common account is the build in Admin account, which is usually disabled.&nbsp;<br>This makes handling security a little bit complicate. &nbsp;<br>Up to five users you can handle it, if permissions are only set on the file server level. <br>VPN can be realized on router level, but also there you have individual accounts. <br><br>So, if you have a server, it is an option to use it also as domain controller to have single authentication. <br>This raised the securtiy level as well as it makes handlich permissions a bit easier. But at the end a question, how much control over permissions you need. <br><br>DCs should not be used in general for other purposes (this is why Microsoft stopped the Small Business Servers), especially under security aspects, but for simple file services, I do not see any problem. <br>Or in other words, DC + File Server is much more secure than any peer to peer network. <br><br>Also a DC can provide a lot of other service like DNS, DHCP and other network related services.&nbsp;
</div>


arnold

<div>
<blockquote>
I &nbsp;have a single windows 2019 standard server ... NOT SETUP as a domain controller. &nbsp;pretty much used as a file server. 
</blockquote>
What hardware? Cause nowadays it is cheap to use two VM's on such a machine for the DC and the file server role.
</div>


<div>
Thank you for the information on the domain controller. I prefer not to set it up as a domain controller is there not any product that will work with just 5 users that will allow us to do 2 factor authentication on the workstations themselves?<br />
<br />
&nbsp;All the workstations are windows 10 pro and they authenticate to the windows 2016 that we use as a file server through their username and password with appropriate &nbsp;Permissions.
</div>


<div>
At least in earlier times, Samba Servers are used as a authenciation instance. But mostly to save money for Microsoft licenses.&nbsp;<br>But no other product than a Microsoft DC integrates so close to other Microsoft OS. So there is not a real alternative.&nbsp;<br>And it is for free, as you have the server. &nbsp;<br>A DC contains a lot of services you can use if you like. But the basic ones is the central authentication and DNS and possibly DHCP.&nbsp;<br>Also following Tony's hint to just setup two virtual machines on it, one as DC, the other as file server, if you have enought ressouces on your server. But for a small environment like yours even possibly not really needed. The construction is a little bit more save due to the fact, that the services are isolated.<br>&nbsp; &nbsp;&nbsp;
</div>


<div>
How will a domain controller allow me to set up a 2 factor authentication like fingerprint reader?
</div>


<div>
It is not exactly a two factor authentication. <br>A two factor authentication you can realize with a smartcard as an additional security token (as a certificate in that case). Also you can use it as a bitlocker cert to physically protect the device.<br>&nbsp;<br>And this you can combine with a traditional logon, fingerprint, face recognition, dependent from your device. <br>The domain controller is the authentication instance, the client provides the identification of the user and maps it to an AD (or even a local account). <br>As smartcards are certificate related, you need either a cert from a public certificate authority or your own PKI.&nbsp;&nbsp;
</div>


<div>
I guess what I am asking is ... is there not a third party product that will make a windows 10 pro ws call or text their cell phone with a code for a 2FA login ? <br />
thanks Tony D
</div>


<div>
Solution with a real two factor authentication - what means you have two independed security confirmations - I have seen for Windows only in combination with a smart card. So this is not only software but also some hardware (smatcard + smartcard reader. <br>Of course you find a lot of such solutions for special applications. I.e. banking, shops etc, where you have beside your user login a procedure based on SMS, TAN, Photo-TAN or whatever. Even with certificate based methods. But these methods are mostly application based. I.e. you logon to a website and you have to confirm an action on this web-site by an additional security action. Nevertheless you are already logged in with a single factor authentication.<br><br>If you transfer this method to a company network, it would mean, you logon into windows and need a second method to start an application. As this is even nowerdays not unusual - but mostly due to other reasons - you already have a partly two factor authentication as far as not the same user id and password is used. <br>&nbsp;<br>For a windows client, it is a little bit more complicate as you have to logon to be able to do something else inside your user context. Of couse there would be the (technical) possibility to combine user ID and password with other methods like fingerprint or face recognition. But this also would enforce, that there is software running in the background, means running on system level. <br><br>I don't want to say, that is it not possible that you find such a solutions. But keep in mind, that I can also take the hard disc from such a device and be possibly able to work around any security. So if you talk about a high security level for pure windows clients, you usually put such options into account. And if the two factor authentication doesn't really protect the data, you havn't really won a lot. Therfore such solutions are mostly combined with certificates, which also allows to encrypte the hard disc, where you find here also software based solutions (i.e. bit locker) as well as BIOS based solutions with a smartcard. Last option is what I mostely have seen in the past. But even bit locker is not a real two factor protection. The logon happens with just your usual login method. <br>In other words, companies, which realized such options, they put the whole scope into their solutions, and the result was (at least what I have seen until now) the smartcard method. Means, you put your smartcard into the computer, and then you are able to logon. Without smartcard, the whole computer is useless. <br>Even such solutions are often combined with using the smartcard other purposes, i.e as door opener. This also avoids, that people let their smartcard inside the computer if they leave the device, i.e. to have lunch.<br>If the people leave they computers open, then it is open anyway, doesn't matter how much security factors you have. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</div>


Tony D

<div>
thank you for all your information.<br />
sincerely Tony D.
</div>


<div>
<div class="content wysiwyg-content">
I &nbsp;have a single windows 2019 standard server ... NOT SETUP as a domain controller. &nbsp;pretty much used as a file server. &nbsp;I &nbsp;need a simple 2FA setup for logon to their<br />
&nbsp;windows 10 desktops and laptops. and vpn access to the server. wehave a Netgear BR500 Router/ Firewall... the router does not have any native 2FA.
</div>
</div>


I  have a single windows 2019 standard server ... NOT SETUP as a domain controller.  pretty much used as a file server.  I  need a simple 2FA setup for logon to their
 windows 10 desktops and laptops. and vpn access to the server. wehave a Netgear BR500 Router/ Firewall... the router does not have any native 2FA.

need simple 2FA

Windows 10 is a personal computer operating system featuring the "universal application architecture" (UAP); apps can be designed to run across multiple devices with nearly identical code, including PCs, tablets, smartphones, embedded systems, Xbox One, Surface Hub and HoloLens. Windows 10 also includes a virtual desktop system, a window and desktop management feature called Task View, the Microsoft Edge web browser, support for fingerprint and face recognition login, voice-based search (Cortana), new security features for enterprise environments, and DirectX 12 and WDDM 2.0 to improve the operating system's graphics capabilities for games.