How to Temporarily Disable Cisco Duo Windows Logon for Emergency Recovery

Cisco Duo is a multifactor authentication (MFA) solution that adds an additional layer of security to Windows computers by requiring users to verify their identity during the sign-in process.

However, there are situations where Duo can prevent an IT technician from accessing a computer to resolve an underlying problem.

For example, a laptop may lose Wi-Fi connectivity, have no available Ethernet connection, and be unable to communicate with Duo’s authentication servers. If offline authentication is not configured or available, the user may be unable to sign in to Windows, even with valid credentials.

This creates a problem: the technician needs access to Windows to repair the network connection, but Duo is preventing them from signing in.

In an emergency, an authorized IT administrator may need to temporarily disable the Duo Windows Logon credential provider to regain access and resolve the underlying issue.

Important: This is a break-glass emergency recovery procedure intended for authorized IT personnel. It temporarily bypasses Duo’s MFA enforcement and should only be performed with appropriate authorization. Duo must be restored and verified immediately after troubleshooting is complete.

Before You Begin: BitLocker Recovery Key Required

You must have access to the computer’s BitLocker recovery key before attempting this procedure if the Windows drive is BitLocker-encrypted.

This recovery method uses the Windows Recovery Environment to access files on the Windows drive. Because most organization-managed Windows computers have BitLocker encryption enabled, you will generally need the recovery key to unlock the drive before accessing the required files.

Without the recovery key, you may be unable to access the encrypted Windows installation, and this recovery method will not work.

Before proceeding, confirm that:

1. You have the correct BitLocker recovery key for the affected computer.
2. The recovery key matches the device’s BitLocker Recovery Key ID.
3. You have valid Windows login credentials.
4. You are authorized to perform emergency recovery on the device.

Where Can You Find the BitLocker Recovery Key?

Depending on how the computer is managed and where its recovery information is backed up, the key may be available through:

• Microsoft Intune: For eligible managed devices with accessible BitLocker recovery information.
• Microsoft Entra ID: For devices whose BitLocker recovery keys have been backed up to Entra ID.

Intune commonly provides access to recovery keys stored in Microsoft Entra ID, so these are not necessarily two separate storage locations.

Some organizations may also store recovery keys in on-premises Active Directory or other enterprise recovery systems.

If you cannot obtain the correct recovery key for a BitLocker-encrypted computer, stop here. Do not proceed until the key is available.

1. Boot Into Windows Recovery Mode

The first step is to access the Windows Recovery Environment (WinRE), which allows administrators to perform troubleshooting tasks outside the normal Windows operating system.

From the Windows sign-in screen:

1. Hold down the Shift key.
2. While holding Shift, click the Power icon in the bottom-right corner.
3. Select Restart.
4. Windows will restart and display the recovery options.

Once the recovery environment loads, navigate to:

Troubleshoot > Advanced options > Command Prompt

If the computer uses BitLocker encryption, you may be prompted to enter the BitLocker recovery key before continuing.

2. Retrieve and Enter the BitLocker Recovery Key

If you have not already retrieved the recovery key, you can obtain it from Microsoft Intune or Microsoft Entra ID, depending on the device’s management and recovery key configuration.

Option A: Retrieve the Recovery Key From Microsoft Intune

1. Open the Microsoft Intune admin center.
2. Navigate to Devices > All devices.
3. Search for the affected computer by its device name.
4. Select the computer from the results.
5. Under the device’s management options, locate Recovery keys.
6. Select Show Recovery Key to reveal the recovery password.

Option B: Retrieve the Recovery Key From Microsoft Entra ID

1. Open the Microsoft Entra admin center.
2. Navigate to Entra ID > Devices > All devices.
3. Search for the affected computer by its device name.
4. Select the computer from the results.
5. Locate the BitLocker recovery key information.
6. Select Show Recovery Key to reveal the recovery password.

Verify the Correct Recovery Key

The Windows recovery screen will display a Recovery Key ID.

Compare this identifier with the information displayed in Intune or Entra ID to ensure you have the correct recovery key.

The BitLocker recovery password consists of 48 digits, typically divided into eight groups of six digits separated by hyphens.

Enter the recovery password as requested on the affected computer.

After the correct recovery key is accepted, the Windows Recovery Environment Command Prompt should become available.

Note: Access to BitLocker recovery keys requires appropriate permissions. Viewing a recovery key is an auditable administrative action.

3. Locate the Duo Windows Logon Installation

Once Command Prompt opens, locate the Duo Windows Logon installation directory.

The typical installation location is:

C:\Program Files\Duo Security\WindowsLogon

One of the components used by Duo Windows Logon is:

DuoCredProv.dll

This DLL is part of Duo’s Windows credential provider integration, which allows Duo to participate in the Windows authentication process.

The emergency recovery method involves temporarily changing the filename of this component so it is not loaded under its expected name.

Confirm the Windows Drive Letter

In Windows Recovery Environment, the Windows partition may not be assigned C:. To inspect the available volumes, enter the following commands one at a time:

diskpart
list volume
exit

Look for the volume that contains the Windows installation. For example, inspect the usual Windows folder on drive C:

dir C:\Windows

If that folder is not present, check another likely letter, such as:

dir D:\Windows

The examples below assume the correct Windows partition is C:. Substitute the actual letter if necessary.

Navigate to the Installation Directory

First, switch to the Windows drive and its root directory:

C:
cd \

Next, navigate to the Program Files directory:

cd "Program Files"

Open the Duo Security directory:

cd "Duo Security"

Then open the WindowsLogon directory:

cd "WindowsLogon"

Alternatively, if the Windows installation is located on drive C, navigate directly using:

cd /d "C:\Program Files\Duo Security\WindowsLogon"

To check whether the expected DLL is present, list the matching files:

dir /a "DuoCredProv.dll*"

For example, the results might include DuoCredProv.dll or a previously created DuoCredProv.dll.bak. Do not assume the directory or component is identical on every Duo version.

Important: Windows Recovery Environment may assign different drive letters than a normal Windows session. Verify the correct drive letter before proceeding.

4. Temporarily Disable the Duo Credential Provider

The emergency recovery procedure temporarily changes the filename of the Duo credential provider component so that Duo Windows Logon cannot load the expected credential provider DLL during Windows sign-in.

The affected file is:

DuoCredProv.dll

The temporary backup filename is:

DuoCredProv.dll.bak

Important: This is a break-glass emergency action. It temporarily disables Duo MFA enforcement at Windows logon and should only be performed by authorized IT personnel with appropriate approval. Restore the file immediately after access is restored and the original issue is resolved.

Command Prompt Commands

From the Windows Recovery Environment Command Prompt, verify the current Windows drive letter if necessary, then navigate to the Duo Windows Logon folder and rename the credential provider DLL.

The examples below assume the Windows installation is on C:. If the Windows partition is assigned a different drive letter in Windows Recovery Environment, replace C: with the correct drive letter.

C:
cd \
cd "Program Files"
cd "Duo Security"
cd "WindowsLogon"
dir /a "DuoCredProv.dll*"
ren "DuoCredProv.dll" "DuoCredProv.dll.bak"
dir /a "DuoCredProv.dll*"
exit

Alternatively, if the Windows installation is on drive C:, you can use a single navigation command:

cd /d "C:\Program Files\Duo Security\WindowsLogon"
dir /a "DuoCredProv.dll*"
ren "DuoCredProv.dll" "DuoCredProv.dll.bak"
dir /a "DuoCredProv.dll*"
exit

Before renaming, confirm that DuoCredProv.dll is present and that DuoCredProv.dll.bak does not already exist. If the backup file already exists, or if the rename fails, stop and verify the installation path, Duo version, and file status before taking further action.

Do not overwrite an existing backup file, force the operation, or attempt to delete the DLL unless the organization’s approved break-glass or repair procedure explicitly requires it.

Once the rename is complete, close Command Prompt and continue booting into Windows.

5. Sign Into Windows

Once Windows restarts and returns to the sign-in screen, multiple Duo-related error dialogs may appear because Windows is attempting to interact with the modified credential provider.

If these dialogs appear:

1. Press Esc to dismiss the Duo error dialogs.
2. Repeat as necessary until the dialogs are closed.
3. Sign in using your normal Windows credentials.

Depending on the Windows and Duo versions, the behavior may differ.

This process does not reset or remove the user’s Windows password. Valid Windows credentials are still required.

6. Troubleshoot and Resolve the Original Problem

Once Windows access has been restored, troubleshoot the issue that originally prevented authentication.

For example, if the problem involves network connectivity, check:

• Wireless adapter: Confirm that Wi-Fi is enabled and the adapter is recognized by Windows.
• Network drivers: Check Device Manager for missing, disabled, or malfunctioning drivers.
• Network configuration: Verify that the computer can connect to an available network.
• IP address and DNS: Confirm that the computer has a valid IP address and can resolve domain names.
• Internet connectivity: Verify access to external services.
• Duo connectivity: Confirm the computer can reach the required Cisco Duo authentication services.

Useful Network Diagnostic Commands

After signing into the normal Windows installation, run these commands in Command Prompt to inspect network addressing, Wi-Fi status, and DNS resolution:

ipconfig /all
netsh wlan show interfaces
nslookup example.com

For example, if the Wi-Fi adapter is disconnected, netsh wlan show interfaces may indicate that it is not connected to a wireless network. ipconfig /all can help reveal an unexpected IP configuration or missing DNS servers.

To check whether an appropriate Duo API hostname is reachable over TCP 443, run this command in PowerShell after replacing the placeholder with the organization’s actual Duo API hostname:

Test-NetConnection api-XXXXXXXX.duosecurity.com -Port 443

Example: A result showing TcpTestSucceeded : True confirms that the TCP connection succeeded. It does not by itself verify Duo authentication or that the applied policy is correct.

If the network is functioning normally but Duo still fails, investigate the Duo installation, authentication policies, account configuration, and diagnostic logs.

Do not consider the incident resolved simply because Windows is accessible. The underlying issue must be corrected.

7. Restore Duo Windows Logon

This step is mandatory. Do not leave the computer operating with Duo MFA disabled.

After resolving the original issue, restore the Duo credential provider to its normal operating state.

Navigate to:

C:\Program Files\Duo Security\WindowsLogon

The temporary backup filename is:

DuoCredProv.dll.bak

The original filename is:

DuoCredProv.dll

Command Prompt Example: Restore the Original DLL

If an authorized technician previously created DuoCredProv.dll.bak, and the original DuoCredProv.dll is absent, the following commands illustrate how to restore the original filename from an elevated Command Prompt:

cd /d "C:\Program Files\Duo Security\WindowsLogon"
dir /a "DuoCredProv.dll*"
ren "DuoCredProv.dll.bak" "DuoCredProv.dll"
dir /a "DuoCredProv.dll"

Important: If the original DLL is already present, if the backup is absent, or if Windows reports that the file is in use, do not overwrite files or force the operation. Use the organization’s approved repair process or reinstall Duo Windows Logon as appropriate. Confirm the installed Duo version and location.

After restoring the component, restart the computer.

Verify Duo Is Working

1. Confirm that Windows starts normally.
2. Verify that the Duo authentication prompt appears during sign-in.
3. Complete authentication using an approved Duo method.
4. Confirm that Windows sign-in succeeds.
5. Check for any remaining Duo errors.
6. Confirm that no temporary emergency access exceptions remain enabled.

A successful Windows sign-in alone does not confirm that Duo is working. MFA must be explicitly tested before returning the computer to service.

Conclusion

Cisco Duo provides important security protection, but issues with network connectivity or authentication software can occasionally prevent legitimate users and IT technicians from accessing Windows.

When standard troubleshooting and offline authentication are unavailable, an authorized break-glass recovery procedure may be necessary.

For BitLocker-encrypted devices, obtaining the correct recovery key is a critical prerequisite. Without it, the technician may be unable to access the Windows installation through the recovery environment.

Once emergency access has been restored, the technician must correct the underlying problem and return Duo to its normal operating state.

Always restore Duo and verify that MFA is functioning correctly before returning the computer to service.

Quick Reference: Emergency Duo Windows Logon Recovery

Use this checklist for immediate action during an authorized emergency recovery.

1. Get the BitLocker key FIRST: Intune or Entra ID > Device > Recovery Keys. Match the Recovery Key ID on screen. No key = no access. Stop and get the key.
2. Boot Recovery Mode: Sign-in screen > hold Shift > Power > Restart > Troubleshoot > Advanced options > Command Prompt. Enter BitLocker recovery key if prompted.
3. Confirm drive letter:

diskpart
list volume
exit
dir C:\Windows

4. Rename the Duo DLL:

cd /d "C:\Program Files\Duo Security\WindowsLogon"
dir /a "DuoCredProv.dll*"
ren "DuoCredProv.dll" "DuoCredProv.dll.bak"
dir /a "DuoCredProv.dll*"
exit

5. Boot Windows and sign in: Dismiss Duo error dialogs with Esc (hold if needed). Sign in with normal Windows credentials.
6. Fix the issue:

ipconfig /all
netsh wlan show interfaces
nslookup example.com

7. Restore Duo (mandatory):

cd /d "C:\Program Files\Duo Security\WindowsLogon"
ren "DuoCredProv.dll.bak" "DuoCredProv.dll"
dir /a "DuoCredProv.dll"

8. Restart and verify: Confirm Duo MFA prompt appears at sign-in. Complete a full Duo authentication. Do not return the device to service until MFA is confirmed working.

If DuoCredProv.dll.bak already exists or the rename fails, do not overwrite. Stop and use the approved repair/reinstall process.