# Question regarding MFA **URL:** \ **Category:** Uncategorized\ **Created:** [March 18, 2024, 9:01pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311 "2024-03-18T21:01:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![toms24x7](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/toms24x7/32/1879_2.png) [@toms24x7](https://openziti.discourse.group/u/toms24x7)\ **Post date:** [March 18, 2024, 9:01pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/1 "2024-03-18T21:01:35Z")
Hi All, I want to enable MFA on the Default policy however i cannot configure MFA on my windows PC when MFA is forced? This is with MFA forced ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/5/54a47f7892982d4e525f86a5fabf118805cfacc3.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/3bf8bfdd339dc83c26000808597d0473087ad1a7.png) This is without MFA force ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/d/d7e1a9c5f0f95662ee00b9c8f944e36f200e52a5.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/d/dc9df9c6b6f8e22c9451d7f2f68164c5e309e8c4.png) I dont understand how it works, How can I force MFA on a tunnel without being able to configure it on the client because it needs to authenticate which i cant because i dont have MFA yet? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 18, 2024, 9:05pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/2 "2024-03-18T21:05:02Z")
Hi @toms24x7, You'd add a posture check to accomplish this. When you create the service-policy, you can add a posture check to that policy. You'd make a posture check that verifies MFA. With the ziti cli it would look something like: ```auto ziti edge create posture-check mfa .... ziti edge create service-policy --posture-check-roles ... ``` hope that helps and makes enough sense. If not, we can go from there ---
**Author:** ![toms24x7](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/toms24x7/32/1879_2.png) [@toms24x7](https://openziti.discourse.group/u/toms24x7)\ **Post date:** [March 18, 2024, 9:15pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/3 "2024-03-18T21:15:07Z")
@TheLumberjack I got the posture check working but now im running into the issue that i cant reauthenticate anymore. Not even with the recovery codes, looks like the Authenticate button does nothing. However this based on the bind and dial policy's right? Because when i enabled the posture checks on the policies and then forced MFA via the auth policy i still couldnt create a MFA option. ---
**Author:** ![toms24x7](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/toms24x7/32/1879_2.png) [@toms24x7](https://openziti.discourse.group/u/toms24x7)\ **Post date:** [March 18, 2024, 9:26pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/4 "2024-03-18T21:26:34Z")
My issue with re authenticating happend after i let the timer run out, after a few restarts of the Ziti program i could authenticate again, works now. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 18, 2024, 10:14pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/5 "2024-03-18T22:14:13Z")
That should not be necessary. Can you look through the logs for related errors? My guess is that your local clock and the controller clock are out of sync. They **must** be in sync for MFA to work reliably/properly. If they are not, you get a situation like you describe where it only "kinda works some of the time" ... (we have seen clocks drift in the past and this issue comes up) ---
**Author:** ![toms24x7](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/toms24x7/32/1879_2.png) [@toms24x7](https://openziti.discourse.group/u/toms24x7)\ **Post date:** [March 18, 2024, 10:31pm UTC](https://openziti.discourse.group/t/question-regarding-mfa/2311/6 "2024-03-18T22:31:26Z")
That worked, my clock was 5 min out of sync 🙂