riderfaiz,
We use Duo for our MFA. Although we do not yet use it for Windows AD logon, we will in the future. I have tested successfully using Duo with the intial offnetwork logon of the day. I've tested it successfully for subsequent Windows logon and I've tested it successfully with RDP logons as well.
We have been using Duo for SSO MFA for the past 12 months for our AnyConnect VPN connectivity and are very happy with this solution.
One thing to note, Cisco is in the process of rolling out an all encompassing mobile security client that combines Duo into their AnyConnect client. I believe they're changing the name to Cisco Secure Access. I believe that's the name. My point is if you haven't implemented and MFA yet, look into the new Cisco secure mobility solution.