Deploy Rublon MFA for Windows using Group Policy (GPO)

Note: This document describes how to deploy Rublon MFA for Windows using a Group Policy Object (GPO) startup script. Note that you can also use PDQ Deploy, SCCM, and Intune to achieve the same results.

Overview of MFA for Windows Using Group Policy

Group Policy allows administrators to centrally manage settings and run scripts on computers in an Active Directory domain. You can use a Group Policy Object (GPO) startup script to deploy the Rublon MFA for Windows Logon and RDP connector to multiple domain-joined endpoints.

The procedure in this document uses the MSI installer. A computer startup script checks the version of the connector installed on the endpoint. If the required version is not installed, the script runs the MSI installer silently and loads the connector configuration from a rublon.conf file stored in a protected network share.

Before You Start

1. Ensure you have an Active Directory domain and permission to create, edit, and link Group Policy Objects.
2. Ensure the target computers are located in an Organizational Unit (OU) to which you can link the deployment GPO.
3. Ensure the target computers can access an SMB share on the domain controller or another trusted file server during system startup.
4. Download the latest MSI installer for the Rublon MFA for Windows Logon and RDP connector.
5. Create a rublon.conf file as described in Using a Configuration File. Ensure that the file contains the correct configuration for all target endpoints.
6. In the examples below, replace DC01, Clients$, and the example OU distinguished name with values appropriate for your environment.

Configure MFA for Windows Deployment Using Group Policy

Prepare the Deployment Share

1. On the domain controller or another trusted file server, create a folder for the deployment files. For example:

C:\Clients

2. Right-click the folder and select Properties. In the Sharing tab, select Advanced Sharing, enable Share this folder, and enter a share name. The examples in this document use the hidden share Clients$.

3. Select Permissions and configure the following share permissions:

Principal	Permission
Domain Admins	Full Control
Domain Computers	Read

4. In the Security tab, configure NTFS permissions that allow the target computer accounts to read the deployment files:

Principal	Permission
SYSTEM	Full control
Administrators or Domain Admins	Full control
Domain Computers	Read & execute, List folder contents, Read

5. Copy the following files to the shared folder:

• RublonForWindows-6.7.0.msi
• rublon.conf

The resulting UNC path used in this document is:

\\DC01\Clients$

If you are deploying the connector only to selected computers, use a dedicated Active Directory security group containing the target computer accounts instead of granting access to all Domain Computers.

Create the Startup Script

1. Create a file named InstallRublonMFA.bat.

2. Paste the following script into the file:

@echo off
setlocal

set "VER=6.7.0"
set "SHARE=\\DC01\Clients$"
set "INSTALLED_VERSION="

for /f "tokens=3" %%A in ('reg query "HKLM\SOFTWARE\Rublon\WindowsLogon\Data" /v Version 2^>nul ^| find /i "Version"') do set "INSTALLED_VERSION=%%A"

if defined INSTALLED_VERSION (
    powershell.exe -NoProfile -NonInteractive -Command "if ([version]$env:INSTALLED_VERSION -ge [version]$env:VER) { exit 0 } else { exit 1 }"
    if not errorlevel 1 (
        endlocal
        exit /b 0
    )
)

msiexec.exe /i "%SHARE%\RublonForWindows-%VER%.msi" RUBLONCONF="%SHARE%\rublon.conf" /qn /norestart /l*vx "C:\Windows\Temp\rublon-gpo-install.log"

set "EXIT_CODE=%ERRORLEVEL%"
endlocal & exit /b %EXIT_CODE%

3. Adjust the following values if necessary:

Value	Description
VER=6.7.0	The connector version you want to deploy. The version must match the MSI filename.
SHARE=\\DC01\Clients$	The UNC path to the folder containing the MSI installer and rublon.conf.
RublonForWindows-%VER%.msi	The MSI filename. Change this value if your downloaded installer uses a different filename.
RUBLONCONF="%SHARE%\rublon.conf"	The path passed to the MSI installer with the only supported connector configuration parameter.

The script checks the Version value under HKEY_LOCAL_MACHINE\SOFTWARE\Rublon\WindowsLogon\Data. If the installed version matches VER, the script exits without running the installer. Otherwise, it installs or updates the connector.

Create and Configure the Group Policy Object

1. Open the Group Policy Management Console by running gpmc.msc.

2. Locate the OU that contains the target computers. Right-click the OU and select Create a GPO in this domain, and Link it here.

3. Enter a name for the GPO, for example, Rublon MFA for Windows Deployment, and click OK.

4. Right-click the newly created GPO and select Edit.

5. Navigate to Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown) and double-click Startup.

6. In Startup Properties, click Show Files and copy InstallRublonMFA.bat to the folder that opens. Close the folder window.

7. Click Add, click Browse, select InstallRublonMFA.bat, and then click OK.

8. To ensure the deployment share is available before the startup script runs, navigate to Computer Configuration → Policies → Administrative Templates → System → Logon. Open Always wait for the network at computer startup and logon, select Enabled, and click OK.

Enabling this policy may increase startup and sign-in time because Windows waits for the network before applying Group Policy.

9. Close the Group Policy Management Editor. Ensure the GPO is linked to the OU that contains the target computers.

Deploy Rublon MFA to Your Windows Endpoints

The GPO will be applied during the normal Group Policy refresh cycle. Because the installation script is a computer startup script, it runs the next time each target endpoint starts.

To refresh Group Policy on an individual endpoint immediately, run the following command as an administrator:

gpupdate /force

Restart the endpoint after the policy refresh. During startup, the script checks the installed connector version and installs Rublon MFA if the required version is not already present.

Optional: Refresh Group Policy and Restart Multiple Endpoints

You can use PowerShell to refresh Group Policy on all computers in an OU. The following example requires the ActiveDirectory and GroupPolicy PowerShell modules and the permissions and firewall rules required by Invoke-GPUpdate.

$ouPath = "OU=Clients,DC=contoso,DC=com"
$computers = Get-ADComputer -SearchBase $ouPath -Filter *

foreach ($computer in $computers) {
    Invoke-GPUpdate -Computer $computer.Name -Target Computer -Force -RandomDelayInMinutes 0
}

After the policy has been refreshed, you can restart the target endpoints:

$ouPath = "OU=Clients,DC=contoso,DC=com"
$computers = (Get-ADComputer -SearchBase $ouPath -Filter *).Name

Restart-Computer -ComputerName $computers -Force

Testing Deployment of Rublon MFA for Windows

After the target endpoints restart, verify the deployment on at least one endpoint.

1. Verify that the expected connector version is stored in HKEY_LOCAL_MACHINE\SOFTWARE\Rublon\WindowsLogon\Data under the Version value.
2. If the installation did not complete, review C:\Windows\Temp\rublon-gpo-install.log on the endpoint.
3. Try to log in to the endpoint. After you provide your username and password, a Rublon Prompt should appear.

You can also use the following PowerShell script to retrieve the installed connector version from all computers in an OU. PowerShell Remoting must be enabled and available on the target endpoints.

$ouPath = "OU=Clients,DC=contoso,DC=com"
$computers = (Get-ADComputer -SearchBase $ouPath -Filter *).Name

Invoke-Command -ComputerName $computers -ScriptBlock {
    $data = Get-ItemProperty -Path "HKLM:\SOFTWARE\Rublon\WindowsLogon\Data" -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        RublonInstalled = [bool]$data
        Version = $data.Version
    }
} | Select-Object PSComputerName, RublonInstalled, Version | Format-Table -AutoSize

Refer to the following instructions for step-by-step guidance on how Rublon Multi-Factor Authentication works after installing the connector:

• Log in to Windows with Rublon 2FA
• Log in to RDP with Rublon 2FA

Updating the Connector

To update the connector to the latest version:

1. Download the latest MSI installer from Rublon Downloads.
2. Copy the new MSI installer to the deployment share.
3. Update VER in InstallRublonMFA.bat so that it matches the version and filename of the new MSI installer.
4. Update rublon.conf if you want to change the connector configuration.
5. Refresh Group Policy and restart the target endpoints. The startup script detects that the installed version differs from VER and runs the new MSI installer.
6. Verify the installed version and test Rublon MFA on at least one endpoint.

You can use the MSI installer to update a connector previously installed using the EXE installer. The MSI installer replaces the application entry created by the EXE installer in the list of installed apps in Windows.

After switching to the MSI installer, we recommend using MSI installers for subsequent updates. Using an EXE installer over an MSI installation creates separate EXE and MSI application entries in Windows.

Optional: Uninstalling the Connector From Multiple Endpoints

The following example silently runs the connector uninstaller on all computers in the specified OU. PowerShell Remoting must be enabled and available on the target endpoints.

$ouPath = "OU=Clients,DC=contoso,DC=com"
$computers = (Get-ADComputer -SearchBase $ouPath -Filter *).Name

Invoke-Command -ComputerName $computers -ScriptBlock {
    $uninstaller = "C:\Program Files\Rublon\Logon\unins000.exe"

    if (Test-Path $uninstaller) {
        Start-Process -FilePath $uninstaller -ArgumentList "/VERYSILENT", "/NORESTART" -Wait -NoNewWindow
    }
}

To uninstall the connector only from selected endpoints, specify their computer names:

$computers = @("WIN11-05", "WIN11-06", "WIN11-07")

Invoke-Command -ComputerName $computers -ScriptBlock {
    $uninstaller = "C:\Program Files\Rublon\Logon\unins000.exe"

    if (Test-Path $uninstaller) {
        Start-Process -FilePath $uninstaller -ArgumentList "/VERYSILENT", "/NORESTART" -Wait -NoNewWindow
    }
}

Troubleshooting Your MFA for Windows Deployment

• Verify that the endpoint computer account can read both the MSI installer and rublon.conf from the deployment share.
• Verify that the GPO is linked to the correct OU and that the endpoint is included in the GPO security filtering.
• Run gpresult /r /scope computer on the endpoint to verify that the deployment GPO was applied.
• Review C:\Windows\Temp\rublon-gpo-install.log for Windows Installer errors.
• If the script runs before the network share becomes available, verify that Always wait for the network at computer startup and logon is enabled.
• Refer to the Troubleshooting section of the Rublon MFA for Windows Logon and RDP documentation.

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts

Rublon 2FA for Windows Logon and RDP

How to deploy Rublon for Windows Logon & RDP on multiple endpoints using PDQ Deploy

How to deploy Rublon for Windows Logon & RDP on many endpoints at once using Microsoft System Center Configuration Manager (SCCM)

How to deploy Rublon for Windows Logon & RDP on many endpoints at once using Intune