Recovering from DUO Security MFA Lockout on Windows Server: Safe Mode Uninstallation Guide
Have you installed an MFA solution like DUO Security on your Windows Server, only to find that you can no longer log in via RDP?
Even in Safe Mode, you might struggle to uninstall the program because the usual removal options don’t work.
Problem: RDP Lockout
MFA solutions such as DUO Security can completely block RDP access if:
- They are misconfigured
- Internet connectivity is lost
Even standard user logins may fail, leaving Safe Mode as the only access method.
Safe Mode Login Works, But Uninstall Fails
- Safe Mode login ✅
- Uninstall via Programs & Features ❌
Why? Because the Windows Installer (msiserver) service does not run in Safe Mode by default.
Solution: Regedit + msiserver Combo
Step 1: Enable Installer in Safe Mode via Registry
- Press Win + R → type regedit and press Enter
- Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
Create a new key:
MSIServer
Set its default value to:
@ = "Service"If you are in Safe Mode with Networking, repeat the same steps under:
SafeBoot\Network\MSIServer
Step 2: Start the Windows Installer Service
Open Command Prompt as Administrator:
net start msiserver
You should see:
Windows Installer service was started successfully
Step 3: Uninstall DUO Security
Now you can:
- Go to Programs & Features and uninstall DUO Security
- Or, run the original .msi installer → choose Repair → Uninstall
Step 4: Reboot and Regain Access
shutdown -r -t 0You should now be able to log in normally.
Tip: Windows Server intentionally disables certain system services in Safe Mode, including Windows Installer. By adding registry entries and starting the service manually, you can temporarily override this behavior to uninstall problematic applications.
