BTW, check it out at www.phonefactor.com/terminalservices

It works well, is easy to manage. Even the paid version (upgraded customer service, more users, more complex configuration), is pretty manageable from a cost POV.

Convenience is a plus. My customers are spread like peanut butter, can't get things to them very easy. Good to not have to send out new tokens alla time. I'm all for pushing off responsibility to users.

Well, hate to say it, but I generally can't stand these users who are unwilling to RTFM or learn a little something to help themselves. Maybe I should come over and wipe their bums. But, good news in this case with phonefactor is that there's not a whole lot for them to lose, break, forget, etc. They haven't managed to get confused about this stuff yet. Only trouble is when they are out of wireless coverage they call me up and ask me to switch their 2 factor authentication account to a nearby landline.

Out of Band 2 factor authentication with PhoneFactor is also a big deal. I'm pretty sure that someone won't be able to phish my users if the 2nd factor goes through a completely different network from that which is connected to her browser.

These guys have made it pretty easy to try. Or rather, hard not to try. The software is free for up to 50 users on a single application. We tried it on our terminal server.

Turns out they have a pretty robust set of agents too. there is an Outlook Web Access Agent that makes it easy to install and manage that app alongside TS to provide coordinated 2-factor authentication. Slight downside is you need to pay on a license fee if you manage more than one app. Worth a look at www.phonefactor.com/solutions/corporate-email

On the other hand, if you implement PhoneFactor just for OWA Authentication, it is free for an unlimited number of users.