u2u2secured
Documentation menu
Windows sign-in

Your own PC (free, codes only)

One person, their own Windows PC, no U2 Secured account. After the password, type the 6-digit code from any authenticator app. It is checked on the PC, and nothing is sent anywhere.

Not yet tried on a real PC

personal-setup on Windows passes its automated tests but has not yet been run on a real Windows PC, unlike the fleet setup. Keep a second administrator account outside the group while you try it.

  1. 1

    Install the MSI, without a token

    PowerShell (Administrator)
    msiexec /i u2secured-windows-0.2.0-x64.msi

    Download and check it as on Install. With no token, nothing is registered and nobody is asked for anything yet.

  2. 2

    Run personal-setup

    PowerShell (Administrator)
    Set-Alias u2auth-admin "$env:ProgramFiles\U2Secured\u2auth-admin.exe"
u2auth-admin personal-setup              # protects the account running it; --user alice for another

    From an elevated PowerShell. It protects the account that runs it; --user names another. It replaces the installer’s fleet configuration with a codes-only one, prints a key and an otpauth:// link for your authenticator app and a set of backup codes, then asks for a code from the app. Only when that code matches does it add the account to “U2 Secured Users”, turn off automatic sign-in for it, and turn off Windows Hello-only sign-in, which would leave no password to protect.

  3. 3

    Try it

    Lock the PC (Windows+L) and unlock it: after the password, type the code from the app. Keep the setup window open until that works.

New phone, new codes

PowerShell (Administrator)
u2auth-admin personal-setup --new-totp   # a new entry, e.g. on a new phone
u2auth-admin backup-codes alice          # a new set; the old ones stop working

The first gives you a new entry for the authenticator app; the second a new set of backup codes, and the old ones stop working.

Want push instead?

Run your PC as a fleet of one: create a free Developer app in this portal, get a registration token, and install as on Install. Install the MSI