Windows Identity Client

This page describes Monofor Identity Client for Windows 2.4.22: what it does, what it needs, how to install and configure it, and what it sends to Monosign. User-facing flows: Windows Identity Client Passwordless Login. Problems, logs and fixes: Windows Identity Client Troubleshooting.

What it does

The client adds Monosign to the Windows logon and lock screen:

• Passwordless logon with a QR code: the user scans the QR code on the tile with the Monofor Identity mobile app and approves. No password is typed.

• Passwordless logon with a push notification: the Push tile (or Send Push Notification on the QR tile) sends an approval request to the user's phone.

• Offline logon: when Monosign cannot be reached, a Device PIN from the mobile app or a one-time recovery code unlocks the computer.

• Remote lock and unlock of the computer from Monosign and the mobile app.

• Session management: locks or logs off the Windows session when Monosign ends the user's session.

• MFA after password (MFA tile), Self Service Portal (password reset and account unlock from the logon screen). These are covered on their own pages.

• Language and branding from the tenant: tile texts in English and Turkish, the company logo on the tiles and in the QR code.

• Audit: logons, errors, offline logons and certificate enrollments are sent to the Monosign audit log.

How passwordless logon works

Windows does not accept a phone approval as a credential by itself. The client turns the approval into a smart card logon:

1. At install, the client creates a TPM virtual smart card on the computer.

2. On a user's first QR logon on that computer, the client enrolls a certificate for the user on that card. It asks your Active Directory Certificate Services (AD CS) for it on behalf of the user, using a dedicated certificate enrollment account configured in Monosign.

3. Every passwordless logon after the approval is a normal Windows smart card logon (Kerberos PKINIT) with that certificate. The private key never leaves the TPM.

A certificate belongs to one user on one computer. A user who signs in on three computers has three certificates. Certificates are renewed automatically at logon before they expire.

Requirements

Download

Components

Prepare Monosign

1. Active Directory and certificates

Follow Configuring Active Directory for Passwordless Login. In short:

• Create a dedicated certificate enrollment account in AD (example monosign_certeu). Use it for nothing else.

• Duplicate Enrollment Agent as Monofor Identity - Enrollment (template name MonoforIdentityEnrollment) and User as Monofor Identity - Client (template name MonoforIdentityClient). Give the enrollment account Read and Enroll on both.

• Publish both templates on the CA (certsrv.msc > Certificate Templates > New > Certificate Template to Issue).

• In Management, open the Active Directory user source > Settings > Certificate Enrollment and enter the account (DOMAIN\user, user@domain or just the user name) and its password.

2. Application key

Create an application for the client and a RestAPI key for it, or a setup key for that application (Management > Application Setup). The installer exchanges a setup key once for the tenant ID, key and secret.

When API security is on for the application, the key needs these permissions. Give it only these.

Treat a setup key like a password and let it expire after the rollout.

3. Identity Client policy (optional)

A policy of type Identity Client Policy can switch these on for the computers it applies to. The service applies them and overwrites the local registry values:

• Debug Mode: writes debug logs (sets DebugMode).

• Log Rotation (days, default 30).

• TLS Verification: verify the server's TLS certificate. Enable after confirming the certificate chain validates on the client computers, otherwise sign-in fails.

4. Users

Each user installs the Monofor Identity app and registers it as an authenticator. The Push tile and Send Push use the authenticator named in DefaultAuthenticator: Mobile (Monofor Identity app, default) or Service (API Service Authenticator).

Installation

Interactive

1. Run the EXE as administrator.

2. Features: select Passwordless Authentication > QR Login (and Push Login if wanted).

3. Environment: enter Your Account URL (Tenant URL) and the Setup Key, or tick I want to use Application Key and Secret, instead of Setup Key. and enter App Key and App Secret. Choose the Authenticator: Monofor Identity (Mobile) or API Service Authenticator (Service). Click Validate.

4. Finish the installer. It creates the TPM virtual smart card at the end (up to 120 seconds).

5. Lock the screen or sign out: the Monosign tiles appear. The first QR logon of each user enrolls the certificate.

Silent

# EXE with a setup key
monofor-identity-2.4.22-win-x64.exe /install /quiet URL="https://account.example.com" KEY="<setup key>" FEATURES="PWLESS,PWLESS_QR,PWLESS_PUSH"

# EXE with application key and secret
monofor-identity-2.4.22-win-x64.exe /install /quiet URL="https://account.example.com" TENANT_ID="<tenant id>" APP_KEY="<key>" APP_SECRET="<secret>" FEATURES="PWLESS,PWLESS_QR"

# MSI (VC++ 2022 x64 must already be installed)
msiexec /i monofor-identity-2.4.22-win-x64.msi /qn URL="https://account.example.com" KEY="<setup key>" FEATURES="PWLESS,PWLESS_QR" /l*v C:\Windows\Temp\monofor-identity-install.log

A child feature needs its parent: FEATURES="PWLESS,PWLESS_QR", not FEATURES="PWLESS_QR".

TPM virtual smart card step

On a first install with Passwordless Authentication, the installer runs monofor-tpm-service.exe install and waits up to 120 seconds. If this step fails, the installation still succeeds and logs InstallTPM failed (non-fatal); QR and Push logons will not work until the step succeeds. Run it again from an elevated prompt:

& "C:\Program Files\Monofor\Identity Client\monofor-tpm-service.exe" install

The result is in Logs\MONOFOR_TPM_*.log. If the card recorded in monofor-identity-security.ini no longer exists (TPM cleared, cloned image), the same command recreates it.

Upgrade

• Run the new installer over the old one. Settings, the device ID, the registered users and their certificates are kept.

• Restart the computer after an upgrade so the logon screen loads the new version. Until then certificate enrollment can fail.

Antivirus exclusions

Exclude C:\Program Files\Monofor\Identity Client\ and C:\Windows\System32\monofor-identity-security.ini from scanning.

Settings

All values are REG_SZ under HKLM\SOFTWARE\Monofor\Identity Client unless noted. The installer writes them; change them only when asked by support.

The client also keeps per-user state in this key. Do not change or copy it between computers.

QR code colours and logo: QR Code Customization. Tile texts: Language Text Customization.

Language and branding

• Tile texts come from the tenant's IdentityClient.* language keys (English and Turkish; the Windows display language decides which). The service downloads them at start and again when they change in Management, after a random delay of up to 5 minutes and at most every 10 minutes. Restart the Monofor Identity - Service to download at once.

• The logo is the tenant's branding logo (QR code watermark), shown on the tiles and in the middle of the QR code. Images up to 16 MB are resized to 256 px. A failed download is retried after 10 minutes.

Audit

The client queues events in Logs\~monosign-audit*.jsonl and the service sends them every 30 seconds (up to 100 at a time). Events from the logon screen and from offline periods therefore arrive later. Data of each event carries provider (QR, Push, QR-Push), mode (online, offline), reason and machine.

When the phone approves a QR logon, the server records Passwordless Login Token Success (description User Signed-in with Passwordless). This means the approval, not the Windows logon: the Windows result is the Login Success / Login Error event from the client.

Uninstall and recovery

• Uninstall from Apps & features or monofor-identity-2.4.22-win-x64.exe /uninstall /quiet. It removes the tiles, the services and the TPM virtual smart card (and with it all Monofor certificates on the computer). Add USERSCLEAR=1 to remove per-user data as well.

• If no one can sign in (for example the password tile is hidden and Monosign is unreachable), start in Safe Mode, sign in with a local administrator and delete the Monofor provider keys ({0133CABD-42B6-4216-BC32-…}) under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers and …\Credential Provider Filters, then restart. See Uninstall Monofor Identity Client - Windows.

Related pages

• Windows Identity Client Passwordless Login

• Windows Identity Client Troubleshooting

• Configuring Active Directory for Passwordless Login

• macOS