Air-Gapped Multi-Factor Authentication
Vialock
RFID smart-card MFA for local Windows accounts — offline, on-device, and running on the legacy PCs everything else ignores.
Tap the card. Enter the PIN. You're in. No network, no cloud, no directory.
Why Vialock exists
The problem
Thousands of production, lab, OT and clinical PCs still sign in with a shared local password. They can't join a domain and often can't reach the internet.
Why normal MFA fails
Cloud MFA needs identity providers, connectivity and modern OS support. Isolated and out-of-support machines have none of those.
The Vialock answer
A USB reader, an encoded RFID card and an optional PIN — real two-factor logon enforced locally, with an audit trail, on the hardware you already own.
Offline by design · No directory required · Audit-ready from day one
The Hardware
Plug in the reader. Tap the card. You're in.
- •USB RFID reader plus encoded Vialock cards — no batteries, no network.
- •Works on Windows 10 and 11, including older and out-of-support fleets.
- •Rollout is per-PC: install, enrol, done — no server to stand up.
- •Cards are cheap to replace and instantly revocable if lost.
USB RFID Reader
Plug in. Enrol. Done.
Vialock RFID Card
Encoded. Revocable. Instant.
What you get
Stronger logon
Card + PIN replaces the shared local password.
Zero infrastructure
No server, no domain, no internet connection.
Estate control
Issue, suspend and revoke cards in seconds.
Audit evidence
Integrity-checked logs, exportable on demand.
Legacy friendly
Runs on the Windows PCs you can't replace yet.
Fast rollout
Install, enrol, tap — minutes per machine.
VIALOCK — MFA for every PC
What Vialock Does
Enrolment
Issue a card in under a minute
- •Admin scans a blank RFID card; Vialock captures its unique UID.
- •Operator details, PIN and access level are bound to that card.
- •Bulk enrolment via CSV import for whole teams or shift rotas.
- •No directory, no cloud tenant — everything stays on the machine.
Enrolment Validation
Guardrails stop bad credentials at source
- •Inline warnings block duplicate UIDs, weak PINs and missing fields.
- •Role and access level are mandatory, so no card is issued 'unassigned'.
- •Each issue is written to the tamper-evident audit log immediately.
- •Cards can be reprinted or re-issued without re-keying operator data.
Card Register
One view of every credential in circulation
- •Live status for each card: active, suspended, lost or expired.
- •Search by UID, owner or role; filter to a single site or shift.
- •Instantly revoke, suspend, reset PIN or release a lockout.
- •Lost card? Revoke in seconds — the logon is dead at the next tap.
Audit Trail
Evidence for auditors, not just logs
- •Every sign-in, failure, revoke and setting change is recorded.
- •Integrity-checked chain detects any tampering with the log file.
- •Severity filters and date ranges for fast incident investigation.
- •One-click export for ISO 27001, Cyber Essentials and NIS2 evidence.
Sign-in Mapping
Modern MFA for legacy local accounts
- •Map cards to existing local Windows accounts — no rebuild, no migration.
- •Shared mode for a kiosk or line-of-business PC; per-user mode elsewhere.
- •Credentials are stored encrypted on the device, never in plain text.
- •Optional MFA-only enforcement blocks password-only sign-in outright.
Security Policy
Tune the controls to the risk
- •Require a PIN as well as the card for true two-factor logon.
- •Auto-lock the workstation the moment the card is removed.
- •Lockout thresholds and cool-down periods defeat PIN guessing.
- •Emergency break-glass access, fully logged and time-boxed.
System & Backup
Recoverable by design
- •Encrypted, passphrase-protected backup of cards, policy and keys.
- •Restore a replacement PC to the same state in minutes.
- •Offline key material for air-gapped and disconnected estates.
- •No dependency on Active Directory, Entra ID or internet access.
Licensing
Simple, offline activation
- •Per-device licence applied from a file — no phone-home required.
- •Machine ID binding keeps entitlement clear across an estate.
- •Status, expiry and seat count visible at a glance.
- •Suits classified, OT and isolated networks with no egress.
Secure your isolated machines with Vialock
Talk to our team about deploying RFID smart-card MFA across your OT, lab or production estate.