Access Server MFA Audit

[PQuintela]

Hi, I recently deployed Google Authenticator on my Access Server installs and aside from a few hiccups it's been working great. One of those hiccups however was that users with old profiles are able to bypass the Authenticator requirements. Is there a way for me to see if users have an Authenticator tied to their account within either the web interface or the CLI? I'd like to give users who don't have one tied to their accounts a gentle shove in the right direction

[openvpn_inc]

Hello PQuintela,

A 2FA bypass is a really serious thing. But I don't think that's what's actually happening here.

Can you verify that you are NOT using the 'openvpn' bootstrap account,
and that you have enabled Google Authenticator,
and that you restarted your Access Server(s) so the new setting is applied,
and that the 'old accounts' are not using autologin type profiles?

Kind regards,
Johan