Skip to content
English
  • There are no suggestions because the search field is empty.

Which token does Windows Logon Manager cache for offline OTP authentication?

Resolve offline authentication failures in Windows Logon Manager by keeping only the user’s active OATH HOTP token enabled

Windows Logon Manager will only cache the OTPs from the first enabled event-based token assigned to the user. If that token is not currently used by the user (not provisioned on the mobile authenticator app and does not have a hard token) then the WLM will not cache OTPs for a token the user does not have, and offline authentication will fail. 

To correct this situation, make sure the user has only one enabled event-based token assigned to their account. 

Best Practices:

  • Event-based tokens (OATH HOTP) should only be used for offline authentication.
  • Time-based tokens (OATH TOTP) should be used for authenticating in all other systems.