Administrators · Windows sign-in
Computer policy: offline, break-glass and Safe Mode
The computer policy decides what happens offline, when the second factor is asked for and who may sign in with a password only. It is signed and sent to every computer at the next sync (at most 60 seconds while online).
Where is it?
«Manage» › «Computers» › «Offline sign-in and break-glass».
Which fields does it have?
| Field | Default | Meaning |
|---|---|---|
| «Allow offline sign-in» | On | Offline, a person who signed in online on that computer uses their offline code |
| «Offline window (days)» | 7 | Since the last sync (1 to 30) |
| «Offline sign-ins per person in the window» | 20 | 1 to 100 |
| «Ask for the second factor at» | Sign-in, unlock, remote desktop | And administrator prompts, if you choose |
| «Always for remote sessions» | On | |
| «Unlock grace (minutes)» | 0 | Up to 60 |
| «Break-glass account» | «None» | Or «Only offline, at the console» |
| «Break-glass account SIDs (at most 2, one per line)» | — | Usually the LAPS-managed local administrator |
| «Safe Mode» | «Ask as offline» | Or «Password only (audited)» |
| «Check the Windows password before asking the phone» | On | |
| «Service accounts that sign in with a password only (SIDs, one per line)» | None | They never get the second factor |
Choose «Save»: «The policy was saved; computers get it at their next sync.»
Validation rules
«Check the policy: 1 to 30 days, 1 to 100 sign-ins, grace up to 60 minutes, valid SIDs and a break-glass SID when break-glass is on.»
Why is it signed?
Computers accept only a policy signed by the service's key. A GPO or a local value cannot widen it.
And the access policy?
The organization's access policy also applies to every Windows sign-in. See Device posture.
Error codes in this article
Was this page helpful?
Thank you. Your answer stays in this browser; nothing is sent.
Sorry about that. Try:
- searching for the exact text of the message or the error code
- the error code index
- asking your organization's administrator