u2u2secured
Documentation menu
Windows sign-in

Enrol users & configure

Enrol each person, then add them to “U2 Secured Users”. Membership is the switch: whoever is in the group is asked for U2 at sign-in, unlock and Remote Desktop, and whoever is not, is not.

  1. 1

    Open an elevated PowerShell

    PowerShell (Administrator)
    Set-Alias u2auth-admin "$env:ProgramFiles\U2Secured\u2auth-admin.exe"

    Every command on these pages runs as an administrator. u2auth-admin is not on the PATH; the alias saves typing its full path in this window.

  2. 2

    Enrol the person before adding them

    PowerShell (Administrator)
    u2auth-admin enroll alice --backup-codes 5

    enroll prints a pairing code: on the person’s phone, in the U2 Secured Authenticator app, they open the Linked tab, tap + and enter it. It also prints a key and an otpauth:// link for their authenticator app, which is their code when the PC is offline, and the backup codes, each usable once. Hand these over privately. The output also suggests Linux commands (apt install qrencode, ssh … import); they do not apply on Windows.

  3. 3

    Add them to the group

    PowerShell (Administrator)
    Add-LocalGroupMember -Group "U2 Secured Users" -Member alice

    Or use Local Users and Groups (lusrmgr.msc). From their next sign-in they are asked for U2. Anyone signing in over Remote Desktop also needs to be in Windows’ “Remote Desktop Users” group, as always.

  4. 4

    Try it

    Lock the PC or use another session, and sign in as that person. The emergency administrator stays outside the group.

Enrol before adding

A group member who has not been enrolled is refused at sign-in (bypass_unenrolled = false). Enrol first, then add them to the group.

Login names

U2 Secured knows a Windows account by its account name in lower case: Alice, .\alice and PC01\alice are all alice. Use that name with enroll and the other commands.

The configuration file

u2auth.conf
; C:\ProgramData\U2Secured\u2auth.conf — written by the installer
api_host          = https://auth.u2secured.com
mode              = push
failmode          = secure
bypass_unenrolled = false
issuer            = U2 Windows
state_dir         = C:\ProgramData\U2Secured\state

The installer writes this file. The PC’s key is not in it: registration keeps the key, sealed, in machine.conf beside it. Edit u2auth.conf from an elevated editor; each sign-in reads it afresh.

Settings that apply on Windows

SettingAs installedMeaning
api_hosthttps://auth.u2secured.comThe U2 Secured service. Set from the MSI’s API_HOST.
modepushpush on a PC you manage: a push, with codes as the fallback. local is what personal-setup writes: codes only, nothing sent anywhere.
failmodesecureWhen U2 Secured cannot be reached and the person has no code: secure refuses the sign-in, safe lets them in on their password alone. Keep secure and give everyone codes.
bypass_unenrolledfalsefalse: a group member who was never enrolled is refused. true lets them in on their password alone; avoid it.
prompt_timeout60Seconds to wait for the phone before asking for a code instead.
issuerU2 WindowsThe name of the entry enroll adds to the authenticator app.
state_dir…\U2Secured\stateWhere the enrolled codes and the queued sign-in events are kept, sealed.
[identity_map](empty)Map a Windows login to the person’s user identifier in your app, e.g. alice = alice@acme.com. Not yet tested on Windows.