How to monitor if DUO client is active on Windows device

[RF031]

Hello,

Which process should we monitor to see if DUO client is actively running on Windows device?

We did find the link https://duo.my.site.com/s/article/5536?language=en_US but we want to check if it is actively running on the device and not if it is installed.

Thanks in advance.

[DuoKristina]

Duo Authentication for Windows Logon (the application the article you linked is about) is not an application or service that actively runs all day, so there's nothing to monitor. It's a credential provider that only gets executed during system login.

Are you asking about something besides Duo Authentication for Windows Logon?

[RF031]

Thanks for your quick reply.
If DUO is not an application or service on a Windows device, then it will indeed be difficult to monitor this.
The only thing that can be monitored is whether DLLs are present?

[DuoKristina · Accepted solution]

I don't understand what you are trying to accomplish. What data point do you want to monitor?

Monitoring if the installation is there by seeing if the DLLs are present lets you know that the end-user did not uninstall the application.

Monitoring the registry keys HKLM\SOFTWARE\Duo Security\DuoCredProv and HKLM\Software\Policies\Duo Security\DuoCredProv lets you know that the configuration is intact and the end-user did not tamper with settings.

If you want to workstation logins authenticating with Duo you might want to do that from the Duo Authentication Logs in the Admin Panel or accessible via Duo Admin API's logging endpoint.

The Duo logon event is also captured locally in the Windows Event Viewer - Application log.

[RF031]

Thanks for the answer.
We were looking for a way to check that DUO client is active on device and not uninstalled by a user. We will work on this and thanks again for the support!