This message was deleted.

I've already figured out how to setup Duo Authentication Proxy and use Duo on all my network devices pointing them to NPS.

You can Remote desktop Gateway, with this you can force login with physical or virtual smart card, normally this can replace MFA as third authentication factor and then restrict RDP server access only from the gateway! Works well.

This is a good idea, however, in our environment, we do require console access. We are an MSP that access most systems through ScreenConnect, which just dumps you on the console.