Protecting RDP - Hardware Token without Automatic Phone Call

[stryker54141]

I'm protecting RDP in my office and some users are using hardware tokens, the rest use Duo Mobile.  For the users with tokens, I'm trying to set them up to use phone call authentication in the event they leave their token at home.  I have everything setup properly, but each time they log on, they receive an automatic phone call.

How do I configure my policy to only call if they hit the "Call Me" button?

[DuoKristina · Accepted solution]

Turn off autopush (i.e. automatic factor selection) at the RDP server where Duo is installed via regedit. Note this is an everybody or nobody setting; it's not configurable per-user.