If a workstation or server is locked, you can choose whether to protect the unlocking of a workstation or server by choosing one of four methods

• AD  Password Authenitcation Only
• Multi-Factor Authentication
• 2nd Factor only (AD Pasword is cached)
• Decided by the Logon Policy