My Smart Logon
NeversKey
Break-glass access to Windows machines when Entra ID is compromised or unavailable.
A key prepared in peacetime and locked in a safe, which still opens the machines when Entra ID cannot. A key you hope to never use.
Nothing to install on the machines
No agent, no service, no driver. A deployment script writes Windows settings and a certificate once; Windows already has the rest: PKU2U, its local identity provider and Remote Desktop in Restricted Admin mode.
An offline root you own
The root key is created on an offline machine and printed: one QR code, or one page per custodian with Shamir shares. No file to keep, no vendor service, no CRL to host.
A key valid a few hours
During a crisis the vault issues a NeversKey for the break-glass account, valid 8 hours by default, on a USB key, a TPM or a PIV card. Every logon is a 4624 event to alert on.
How it works
- The vault (
NeversKeyVault.exe, offline): create the root, print its backup, export its public certificate. - Prepare the machines (
NeversKey.exe, administrator workstation): a deployment script, run once per machine as SYSTEM through Intune, a GPO or any tool, puts the root inLocal Cert Issuer(not in the trusted roots), enables the local identity provider and Restricted Admin mode, and creates a machine certificate. A read-only audit script and an HTML report show which machines can be recovered. - The crisis: the administrator requests a NeversKey and reads its code out by phone; the vault answers with a certificate valid a few hours.
- Connect: NeversKey checks the certificate of the machine, then opens
mstsc /restrictedadminwith the NeversKey. No password, no Entra ID, no network service. - End the crisis: the NeversKey is deleted and every change of the connection undone.
Videos
The one setting that needs explaining: PKU2U
The crisis logon is a PKU2U logon, so the settings enable Network security: Allow PKU2U authentication requests to this computer to use online identities (AllowOnlineID = 1) on the machines and on the administrator workstation.
- Microsoft's guidance for this policy: Disabled for on-premises only environments, Enabled for hybrid and Entra joined environments, where remote connections to Entra joined devices need it. It is enabled by default on Windows clients since Windows 10 1607, disabled on servers.
- The DISA STIG (Windows 11: WN11-SO-000185) asks for Disabled. Its rationale is about domain-joined systems, but its check has no exception for Entra joined machines.
- To stay compliant, some turn off Network Level Authentication for Remote Desktop instead, which is far worse: every machine then shows its logon screen to anyone on the network.
- What it opens with NeversKey: a PKU2U logon is accepted only with a certificate whose chain ends in the machine's own
Local Cert Issuer, where NeversKey puts its offline root and nothing else that can issue logons. The audit flags any other certificate in that store.
Record it as a deliberate, audited exception in your compliance tool.
Where the name comes from
Nevers: the secret thrust
In Le Bossu, the novel Paul Féval wrote in 1857, the Duke of Nevers owns a secret sword thrust that no one can parry. The hero, Lagardère, learns it from him. In French, la botte de Nevers still means the decisive move, kept for the end, when everything else has failed.
Never: jamais
Read in English, Nevers becomes never. NeversKey is the key that never gives way, and the one you hope to never use.
Status
NeversKey is in development: the vault, the backups, the deployment and audit scripts, the NeversKey on a USB key and the crisis connection work on Windows 10, Windows 11 and Windows Server 2019 to 2025.
Want to try it on your machines? Contact us.