There may be situations in which it becomes important to bypass the AuthAnvil Two Factor Auth Windows Logon Agent to remove it.
Some examples could include:
•A defect in the agent causing logon failure
•No access is available to the AuthAnvil Two Factor Auth Web Service, and offline caching mode is not enabled
•Need to change the Override Password without logging in
These should be rare occasions and examples that should not be taken lightly. The purpose of the agent is to enforce strong authentication, and it significantly weakens that purpose when people take it upon themselves to unload the agent.
Server 2003 and Windows XP
Microsoft makes it rather easy to install and uninstall logon agents. It’s really just a registry setting located at HKLM\SOFTWARE\Microsoft\WindowsNT\Current\Version\Winlogon in a key called GinaDLL. Any DLL named in that key, and which is located in the %SYSTEM32% directory, will be loaded at boot.
To quickly remove AuthAnvil Two Factor Auth windows logon support, run the AuthAnvil Two Factor Auth Windows Logon Agent uninstall or simply delete the GinaDLL registry key item. Rebooting the computer will then allow for a normal Windows logon sequence.
If there is no access to the uninstaller, or you cannot remove the registry key, reboot the server or workstation into Safe Mode Without Networking. On Safe Mode Without Networking boot, Windows will NOT load the logon agent defined in the GinaDLL registry key. You can then login with your normal Windows Administrator credentials and either completely uninstall the AuthAnvil Two Factor Auth agent, or simply delete the GinaDLL key. Rebooting the computer will then allow for a normal Windows logon sequence.
Note: As of April 8, 2014 Windows XP is no longer being supported.
Server 2008 and Windows Vista
Likewise the Credential Provider utilizes a registry setting that loads the AuthAnvil Two Factor Auth Credential Provider at boot. You can find that in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{ABAA8F45-5683-42b5-BC15-E44D6CBB8ED4}.
To remove a credential provider, you should boot into safe mode without networking or remotely connect to the registry and remove the registry key named above and reboot the computer.
Questions?
If you have any questions or need some help, we would be happy to assist. Open a case at help.scorpionsoft.com or send an email to support@scorpionsoft.com.