Mideye endpoint requirements: Windows, network and directory
This page is for the administrator who plans a rollout. It lists the supported Windows versions and sign-in scenarios, and what the computer, the network and the directory must provide.
Windows versions
Section titled “Windows versions”| System | Status |
|---|---|
| Windows 11 (x64) | Supported. Standalone and Fleet, console and Remote Desktop. Restart after the install, see Install. |
| Windows Server 2019, 2022, 2025 (x64) | Supported. |
| Windows 10, Windows Server 2016 | Not tested. Verify on your own image before you roll out. |
| Windows on ARM, 32-bit Windows | Not supported. The endpoint is x64 only. |
| Windows Server Core | Mideye Configuration is not installed there. Use the mideye cp command line. Sign-in on Server Core has not been tested. |
Sign-in scenarios
Section titled “Sign-in scenarios”| Scenario | Support |
|---|---|
| Console sign-in | Yes. |
| Unlock | Yes. The tile unlocks only the account whose session is locked. Someone else uses Switch user (Windows Server) or Sign in as another user on the Mideye tile (Windows 11). |
| Remote Desktop with NLA | Yes. The client’s credentials are used and the tile asks only for the second factor. |
| Remote Desktop without NLA | Yes. The tile asks for user name and password. |
| Expired password | Yes, at the console. The tile asks for a new password after MFA. Over Remote Desktop with NLA, Windows refuses an expired password before the session starts. |
Network sign-ins, runas, UAC prompts, services, scheduled tasks | Not covered. They never show the Mideye tile. |
Remote Desktop clients that auto-submit saved credentials behave differently between client versions. Test your own clients.
The package
Section titled “The package”One file, mideye-credential-provider-<version>-x64.msi, covers every mode. Release builds are signed by Mideye AB.
| Mode | What it installs |
|---|---|
| Admin | The tools and the Group Policy templates only. No credential provider and no service. Use it on an administrator’s workstation. |
| Local (standalone) | Everything, with the configuration kept on the computer. The Mideye Agent service is installed but stopped. |
| Fleet | Local, joined to Mideye Fleet during the install. The policy comes from Fleet. |
On the computer
Section titled “On the computer”| Item | Requirement |
|---|---|
| Rights | Local administrator. A silent install must run from an elevated prompt. |
| Other Mideye products | No older Mideye Credential Provider may be installed. The installer refuses and asks you to uninstall it first. |
| Runtime | Nothing to install. The DLLs link the C runtime statically and the tools are single programs. |
| Application control | A signed release MSI runs with Smart App Control and WDAC when they trust the Mideye AB publisher. Allow that publisher in AppLocker or WDAC. |
| TPM | Only for offline sign-in with an authenticator app: a TPM 2.0, or a virtual TPM on a virtual machine. Install and online sign-in do not need one. |
| Clock | The break-glass code depends on the clock. Keep time correct. |
Network
Section titled “Network”| From | To | Why |
|---|---|---|
| The computer | Mideye Cloud, or one to five Mideye Server URLs (HTTPS) | The sign-in check, before anyone is signed in. Open the ports of those URLs outbound. A proxy can be configured. |
| The computer (Mideye Cloud only) | portal.prod.mideye.com (HTTPS) | Reads the expiry of the API key, at most every 6 hours. If blocked, sign-ins still work. |
| The computer (Fleet) | The Fleet node API, port 9444 by default | Join, heartbeat, policy and events. Outbound only, with mutual TLS. Fleet never connects in. |
| The computer | A domain controller (LDAP) | Looks up the phone number, token serial and group membership of domain accounts. |
TLS to a Mideye Server uses the Windows certificate store or a pinned public key. A new Mideye Server has a self-signed certificate, so pin it. There is no setting that turns certificate checking off.
Backends
Section titled “Backends”| Backend | Touch | One-time code | Assisted Login | Authenticator app |
|---|---|---|---|---|
| Mideye Cloud | Yes | Yes (hardware tokens) | By phone | No |
| Mideye Server 6.6.6 | Yes, when the server is connected to Mideye Cloud | Yes | By phone or with codes | Yes, also offline |
Mideye Server 6.6.11 adds Methods Lookup: each user is offered only the methods they have (domain accounts only). An air-gapped Mideye Server cannot send Touch. The endpoint then asks for the one-time code, or you turn Touch / Magic Link off.
Directory
Section titled “Directory”The tile works with Active Directory domain accounts and with local accounts.
- Mideye Cloud: for domain accounts the endpoint reads the phone number from
mobileand the token serial fromipPhoneby default (you can change the names on the Connection page). For local accounts you type the phone number or token serial on the Users page. - Mideye Server: the server finds users, phones and tokens in its own database or LDAP. A local account needs a Mideye Server database user with the same name. See Connect Mideye Server.
Remote Desktop
Section titled “Remote Desktop”Keep Network Level Authentication (NLA) on and keep Remote Desktop off untrusted networks. The installer raises the RDP logon timeout to at least 240 seconds so that an MFA round trip fits. See Remote Desktop.