Set-DAOtpAuthentication

Set-DAOtpAuthentication

Configures one-time password (OTP) authentication settings for DirectAccess (DA).

Sintaxis

Parameter Set: Set3
Set-DAOtpAuthentication [-AsJob] [-CAServer <String[]> ] [-CertificateTemplateName <String> ] [-CimSession <CimSession[]> ] [-ComputerName <String> ] [-DisableTwoFactorBypass] [-PassThru] [-SigningCertificateTemplateName <String> ] [-ThrottleLimit <Int32> ] [-UserSecurityGroupName <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

Descripción detallada

The Set-DAOtpAuthentication cmdlet modifies the DirectAccess (DA) one-time password (OTP) settings, including certification authority (CA) servers, the certificate template used to issue one-time password (OTP) certificates, and users exempt from two-factor authentication.

Parámetros

-AsJob

-CAServer<String[]>

Specifies the CA servers that issue certificates for OTP authentication.

-CertificateTemplateName<String>

Specifies the name of the certificate template used for OTP.

-CimSession<CimSession[]>

Ejecuta el cmdlet en una sesión remota o en un equipo remoto. Escriba un nombre de equipo o un objeto de sesión, como la salida de un cmdlet New-CimSession o Get-CimSession. El valor predeterminado es la sesión actual en el equipo local.

-ComputerName<String>

Specifies the IPv4 or IPv6 address, or host name, of the server on which the cmdlet should run.

-DisableTwoFactorBypass

Disables the option to allow users in a specific security group to be exempt from two-factor authentication, when two-factor authentication is enabled.

-PassThru

Devuelve un objeto que representa el elemento con el que está trabajando. De forma predeterminada, este cmdlet no genera ningún resultado.

-SigningCertificateTemplateName<String>

Specifies the name of the certificate template used to enroll the certificate used by Remote Access to sign certificates used for OTP authentication.

-ThrottleLimit<Int32>

Especifica el número máximo de operaciones simultáneas que se pueden establecer para ejecutar el cmdlet. Si se omite este parámetro o es especifica un valor de 0, Windows PowerShell ® calcula un límite óptimo para el cmdlet en función del número de cmdlets de CIM que se estén ejecutando en el equipo. El límite solo se aplica al cmdlet actual, no a la sesión ni al equipo.

-UserSecurityGroupName<String>

Specifies a security group containing users who are exempt from two-factor authentication.

-Confirm

Solicita confirmación antes de ejecutar el cmdlet.

-WhatIf

Muestra lo que sucedería si se ejecutara el cmdlet. El cmdlet no se ejecuta.

<CommonParameters>

Este cmdlet admite los siguientes parámetros comunes: -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer y -OutVariable. Para obtener más información, consulte about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).

Entradas

El tipo de entrada es el tipo de los objetos que se pueden canalizar al cmdlet.

• None

Salidas

El tipo de resultado es el tipo de objetos que emite el cmdlet.

• Microsoft.Management.Infrastructure.CimInstance#DAOtpAuth

  El objeto Microsoft.Management.Infrastructure.CimInstance es una clase contenedora que muestra objetos de Instrumental de administración de Windows (WMI). La ruta de acceso después del signo de número (#) proporciona el espacio de nombres y el nombre de clase del objeto WMI subyacente.
  The DAOtpAuth object contains the following OTP authentication configuration settings for DirectAccess:
  -- OtpStatus specifies whether OTP authentication is enabled or disabled.
  -- RadiusServer specifies the OTP RADIUS server names and addresses.
  -- UserSecurityGroupName specifies the security group of users that are exempt from two-factor authentication.
  -- CAServer specifies the CA servers used for OTP authentication.
  -- CertificateTemplateName specifies the name of the OTP certificate template.
  -- SigningCertificateTemplateName specifies the name of the certificate template used to enroll the certificate used by Remote Access to sign certificates used for OTP authentication.

Ejemplos

EXAMPLE 1

This example changes OTP setting for both DC1.corp.contoso.com\corp-DC1-CA and DC2.corp.contoso.com\corp-DC2-CA CA server to be used for OTP authentication. Other OTP settings will not be changed in any way. This cmdlet can be used to change single or multiple OTP settings.
Note: This cmdlet will fail if OTP authentication is Disabled.

PS C:\> Set-DAOtpAuthentication -CAServer @(DC1.corp.contoso.com\corp-DC1-CA, DC2.corp.contoso.com\corp-DC2-CA) –PassThru

EXAMPLE 2

This example enables two-factor authentication exemption feature and sets CORP\DirectAccessUsernamePasswordUsers as security group of users who are allowed to use username and password as user authentication for DA.
The appropriate user group should be created in advance before DA admin can configure OTP for DA. A DA administrator cannot add users to this group via the DA administrator console.

PS C:\> Set-DAOtpAuthentication -UserSecuriotyGroupName corp\DirectAccessUsernamePasswordUsers –PassThru

EXAMPLE 3

This example disables two-factor user authentication exemption feature and all DA users must use two-factor authentication such as Smart Card or OTP, as user authentication for DA. The value of the UserSecurityGroupName parameter is cleared and next time two-factor authentication feature is Enabled again, the DA administrator will have to supply the name of user security group.

PS C:\> Set-DAOtpAuthentication –DisableTwoFactorBypass –PassThru

Temas relacionados

Disable-DAOtpAuthentication

Enable-DAOtpAuthentication

Get-DAOtpAuthentication